If I had to guess he found a way to commit a Diffie Helman point into a 2-2 LN channel locking script. Anlther option would be in a "semi permanent HTLC" lock. But I'm very interested in the actual solution. I just like speculating.