$6M Bounty Paid to White Hat Hacker Likely Averts Sizable DeFi Hack

Developers behind the Aurora protocol acknowledged they should have spotted the vulnerability much earlier

article-image

Blockworks exclusive art by axel Rangel

share

key takeaways

  • No user funds were lost or stolen before the loophole was discovered
  • Up to $200 million worth of Aurora users’ funds could have been hacked if this bug wasn’t fixed

It was almost the next market-moving DeFi hack. 

Aurora, an Ethereum Virtual machine built on the NEAR Protocol, recently paid a $6 million reward to a so-called white hat hacker for identifying a key bug. 

The hacker, known as pwning.eth, uncovered in April a critical vulnerability in Aurora’s system, which could have jeopardized up to $200 million of funds. Virtual machines power smart contracts, or transactions executed in code on the blockchain without intermediaries, on Ethereum. Aurora paid the bounty through the Immunefi platform. 

It marks one of the largest-ever known bounty payouts in DeFi (decentralized finance) history. Last month, crypto bridge Wormhole — which connects different blockchains — paid $10 million to an ethical security hacker that also discovered a bug through Immunefi’s platform.

“Such a vulnerability should have been discovered at an earlier stage of the [defense] pipeline and we have already started improving our methods to achieve that in the future,” Frank Braun, Aurora’s head of security, said in a statement Tuesday. 

Added Braun: “However this event ultimately proves that our security mechanisms work.”

The bug was initially flagged via Immunefi — crucially, before any funds were stolen. Aurora’s bounty program with Immunefi was launched in April 2022, with rewards ranging from $1,000 to $6 million, depending on severity. 

Jonah Michaels, a spokesperson for Immunefi, told Blockworks that at “a time of distrust in the markets, it’s important more than ever for Web3 projects to show that they take security seriously.”

On Immunefi’s platform, security researchers review code and disclose vulnerabilities. Through its programs with DeFi projects, Immunefi said it paid over $40 million in bounties to friendly hackers — claiming to have prevented over $20 billion in potential damages.

Aurora’s goal is to provide application developers the means to operate on Ethereum-compatible platforms under the governance of the decentralized Aurora DAO. Aurora’s scaling solution is currently responsible for $373 million of NEAR’s $786 million in total value locked, according to data provider DefiLlama.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Flashnote Template Presentation (2).jpg

Research

With the recent election, it’s clear that there will be a meaningful shift in crypto regulations and legislation. Trump is likely as pro-crypto as a president can be. He launched (multiple) of his own NFT collections and is launching an Aave wrapper called World Liberty Fi. He has also spoken out and mentioned that he wants to make the United States "the crypto capital of the planet" and transform it into the "Bitcoin superpower of the world". He proposed creating a strategic national Bitcoin stockpile alongside support from Senator Cynthia Lummis, promising to retain 100% of all Bitcoin held by the U.S. government. More importantly, we’re likely to see deregulation across the board in a lot of industries, with crypto being one of them - as Trump has committed to keeping the crypto market largely unregulated. Crypto, DeFi in particular, has historically been knee-capped by overreaching and hostile governmental agencies and regulation by enforcement, as evidenced by the plethora of Wells notices and lawsuits over the past few years. With Donald Trump winning the presidency, Republicans taking control of the Senate, and being on the verge of securing the House, we think it’s likely that crypto realizes positive regulatory clarity. Below, you can find our analysts’ takes:

article-image

Researcher Justin Drake’s Beam Chain proposal aims to transform Ethereum’s consensus layer with zk proofs and post-quantum cryptography

article-image

Gunzilla’s Theodore Agranat said that blockchain technology helps “enhance’ gamer experience

article-image

BTC continues to smash expectations as it holds near $90,000

article-image

Inflation is higher than it was in 2016, and the Fed is just at the beginning of its rate-cutting cycle

article-image

Bitwise’s Matt Hougan expects BTC to hit $100,000 by the end of the year and continue upward in 2025

article-image

Midwest Blockchain Week showed the depth of talent available at US universities while focusing on how memecoins could bring back the retail investor