The address that emptied Blockstream's Liquid federation wallet on Sunday has broadcast a transaction sending most of the bitcoin back, after a negotiation conducted entirely inside bitcoin transactions.
Blockstream has not said anything publicly since Liquid's first statement on Sunday evening. Every message it has sent the attacker went into an OP_RETURN field, PGP-signed.
The transaction pays 3,400 BTC, worth about $268 million, to the federation address, and sends 598.49955894 BTC, about $47.2 million, back to the address that took it. That is 15% of the 3,998.50 BTC withdrawn. It carries a fee of 1,768 satoshis, a rate of 0.77 satoshis per virtual byte, and all 16 inputs are flagged for replace-by-fee, so it can be replaced with a different transaction while it waits. It was still unconfirmed at 15:50 UTC on Monday.
Blockstream opened the channel at 19:31 UTC on Sunday with 1,000 satoshis and the text “Please contact security@blockstream.com.”
It sent two encrypted messages early Monday, at 01:33 and 01:49 UTC, the second labeled as Electrum BIE1 ECIES encrypted to the key behind the attacker’s address.
