Before getting into the hack, it helps to understand what Liquid is. Liquid is a sidechain built by the company Blockstream that lets people move value faster and with more privacy without changing bitcoin itself. You deposit real bitcoin into a wallet controlled by the Liquid federation and receive L-BTC to use on the sidechain. L-BTC is effectively an IOU: each one is supposed to represent one real bitcoin held by the federation. This is a centralized system built on top of bitcoin. It is not bitcoin itself.
The hack broke that IOU system. Liquid hides transaction amounts, so it uses a balance proof to show that hidden inputs and outputs add up and a range proof to make sure somebody has not balanced a giant positive output against a negative one. The range proofs are expensive to verify, so Liquid cached successful checks. The attacker found a way to point malicious data at a valid cached result. Affected nodes thought the range proof had already passed, accepted nearly 4,000 unbacked L-BTC, and let the attacker redeem those IOUs for roughly 3,996 real bitcoin from the federation wallet. Bitcoin continued doing exactly what it was supposed to do.
The self-described white hats returned 3,400 bitcoin after Blockstream patched the flaw, but kept 598.5 bitcoin, worth roughly $47 million at the time, and demanded a 10% bounty. Blockstream has refused and says that taking assets without authorization and withholding them is theft. Ordinary Liquid transactions have resumed, while peg-outs remain disabled and the reserve is restored.
I think the genuinely interesting part is the ethical question. If you discover a vulnerability and believe exploitation is imminent, taking endangered funds into temporary custody may be the least harmful option. You should probably protect them before someone else steals the whole amount. But then what? I think you return every sat once the system is safe and negotiate a reasonable bounty for the service you provided. Keeping nearly 600 bitcoin and threatening the owners until they accept your price is extortion with better branding. Calling yourself a white hat in an OP_RETURN message does not make you one.
Jack Mallers gave the clearest plain-English breakdown I have heard. Start at 41:58 for the balance proof, range proof, and cache explanation.