The negotiations were conducted entirely in OP_RETURN messages, ending with 3,400 BTC back in the federation wallet. The white hats held out until Blockstream confirmed that every bridge node was patched; about 4 hours later, they moved the coins but kept 598.5 BTC as a bounty.