If it were me and I were in the Liquid white hat hacker's position, I would have taken the ~4000 Liquid bitcoin to stop others from doing it, then returned the full amount and then asked for a reward. I would have explained that as soon as I found the vulnerability, I thought by the time I did a responsible and private disclosure that someone else could have swept the funds. I would have hoped for a 1% reward from Blockstream for my good nature. The "white hat" taking ~15% is called theft.