Bribing Hackers Seems to Work: 3 Hacks Returned in 3 Months

Euler Finance, Sentiment and Allbridge have all seen stolen funds being partially returned

article-image

solarseven/Shutterstock modified by Blockworks

share

A number of DeFi protocols that have suffered attacks over the past year have been able to successfully recover at least part of their stolen funds, due in part to post-attack-negotiated bounty offers.

Most prominently, lending protocol Euler Finance — which was exploited for nearly $200 million in a series of flash loan attacks — saw its hacker return 100% of its recoverable funds

“Following successful negotiations, all recoverable funds were returned,” Euler Finance said in a blog post. 

“The return represents one of the largest recoveries of stolen assets in blockchain history,” the company said. “It follows an intensive investigation involving collaboration between security professionals, law enforcement, and community volunteers.”

More recently, liquidity protocol Sentiment also managed to recover $900 thousand of its stolen funds, or around 93% of the total stolen. Sentiment had come to an agreement with the attacker, allowing them to keep $66,000 of the hacked funds.

“As per the terms we will end our investigation into the exploiter’s identity,” the company wrote in a statement posted on Twitter

Bridging platform Allbridge, which was drained of $573,000, also ended up in a similar situation.

“1500 BNB was returned to our team. The remaining funds will be considered a white hat bounty to this person,” Allbridge noted in a tweet. 

Why are hackers returning stolen funds?

At a glance, David Schwed, the chief operating officer of blockchain security firm Halborn, told Blockworks that the alleged black-hat hackers might feel morally obliged to return the stolen funds after being offered a bug bounty.

“[The] hacker [may feel] that they proved the exploit and keeps some of the [money] and justifies it as a bounty and not stolen funds,” Schwed said. 

He also suggested that the attackers may only be returning the stolen funds to remove the pressure and consequences of having their identities revealed. Or it is possible that the exploiters are “truly white-hat hackers trying to shed light on poor security,” though Schwed noted that this thought was “more out there.”

This sentiment was shared by Hugh Brooks, the director of security operations at CertiK, a blockchain ​​security-focused ranking platform. 

Brooks told Blockworks that the past few DeFi hacks should highlight the importance of having proactive bug bounty projects. 

“While some platforms do offer white hat bug bounties to security researchers who willingly disclose vulnerabilities, many do not, which means there is no way for someone with knowledge of a vulnerability to profit from it,” Brooks said.

He noted however that retroactive bug bounties may not always be the solution. 

“A nearly $200 million theft is no small feat. The practicalities of securing, laundering, and selling or spending these funds is daunting, especially to an amateur hacker. Attacks that have been pulled off by professional hacking groups rarely see any funds returned,” Brooks said. “A proactive approach to securing a platform and its users against all forms of cyberattack is essential.”

Although there are ongoing challenges with hacks, Rachel Lin, CEO and co-founder of derivatives protocol SynFutures, believes that the simple fact that exploiters are returning hacked funds “reflects how the crypto ecosystem is evolving to handle the hacks and frauds that have been plaguing our industry.”

“High-profile hacks continue to draw the media’s attention to DeFi’s weakness. Yet it’s also important to acknowledge that the industry is still in its nascent stage. In the near to medium-term, the industry will likely develop more effective strategies to mitigate these risks and protect user funds,” Lin stated. 

In the specific case of Euler, on-chain analysis played a key role in identifying “Jacob” — the alleged attacker — and compelling this person to return the stolen funds, according to Lin.

“This is a great example of how the transparency of blockchain and cryptocurrencies in general make them a less viable option for criminals. That’s unlike fiat, which still accounts for the overwhelming majority of criminal transactions,” she said.

Lin added that, “if governments around the world are willing to work with the crypto industry instead of fighting it, then I’m sure we can effectively deal with illicit activities while also ensuring privacy for everyday users.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates.png

Research

Despite ending its points program, Hyperliquid has maintained a dominant market position with 77% of perpetuals DEX volumes, though overall volume has decreased from early 2025. It is the only DEX that has been able to compete with CEX volumes. Hyperliquid's success stems primarily from rapid, relevant token listings and superior UX for users and market makers, particularly its API - which is how market makers interact with the protocol. The controversial oracle price override during the JELLY incident exposed risks in the Hyperliquid Liquidity Pool (HLP), though the team has since implemented risk management adjustments. The HyperEVM is currently underoptimized and lacks necessary precompiles, but represents an important strategic expansion to enable asset issuance and DeFi composability.

article-image

The Balkan micronation went from Bitcoin economy to blockchain buzzwords in 10 years

article-image

While BTC’s year-to-date price drop resembles that of the S&P 500, some crypto stocks have fared way worse

article-image

The first batch of earnings reports from big banks shows lending is on the rise, a sign businesses and consumers are feeling better about the economy

article-image

Movement is “conducting an internal investigation stemming from recent events,” according to a company Slack message

article-image

Four firms prepare their launches on the Toronto Stock Exchange while the SEC mulls proposals

article-image

Publicly-listed Janover announced last week that a group of ex-Kraken employees had acquired a majority stake in the company