It's good that at least they are communicating which means they are probably genuine whitehaters. 

I highly suspect there's some insider or former employee did this. Why did blockstream even think they woul talk over email?

Coinsreporter

I think the "Yes, thank you" is a reply to first message. Just confirmed in same block as hacker's new message.

8:27 PM PDT - WHH: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." [+ PGP-encrypted details to Blockstream]

8:30 PM PDT - Blockstream: "Yes, thank you." (PGP-signed; answers the 7:20 question, not the 8:27 one — confirmed in the same block)

bitcoin

Liquid "whitehat" trying sending funds back?

Scoresby

I think the "Yes, thank you" is a reply to first message. Just confirmed in same block as hacker's new message. 

Samson Now [describes](https://x.com/Excellion/status/2096819523550855255) it like this:

> 8:27 PM PDT - WHH: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." [+ PGP-encrypted details to Blockstream]
> https://mempool.space/tx/83825b2135dd0abac12c9dfe17f29ab81b3427e1ae864947b0bebce5e47c3c4b

> 8:30 PM PDT - Blockstream: "Yes, thank you." (PGP-signed; answers the 7:20 question, not the 8:27 one — confirmed in the same block)
> https://mempool.space/tx/8a444eed65c4584f138e08ee138f61490ef73e84f71e14dac3ca66c230cf7e97