Bribing Hackers Seems to Work: 3 Hacks Returned in 3 Months

Euler Finance, Sentiment and Allbridge have all seen stolen funds being partially returned

article-image

solarseven/Shutterstock modified by Blockworks

share

A number of DeFi protocols that have suffered attacks over the past year have been able to successfully recover at least part of their stolen funds, due in part to post-attack-negotiated bounty offers.

Most prominently, lending protocol Euler Finance — which was exploited for nearly $200 million in a series of flash loan attacks — saw its hacker return 100% of its recoverable funds

“Following successful negotiations, all recoverable funds were returned,” Euler Finance said in a blog post. 

“The return represents one of the largest recoveries of stolen assets in blockchain history,” the company said. “It follows an intensive investigation involving collaboration between security professionals, law enforcement, and community volunteers.”

More recently, liquidity protocol Sentiment also managed to recover $900 thousand of its stolen funds, or around 93% of the total stolen. Sentiment had come to an agreement with the attacker, allowing them to keep $66,000 of the hacked funds.

“As per the terms we will end our investigation into the exploiter’s identity,” the company wrote in a statement posted on Twitter

Bridging platform Allbridge, which was drained of $573,000, also ended up in a similar situation.

“1500 BNB was returned to our team. The remaining funds will be considered a white hat bounty to this person,” Allbridge noted in a tweet. 

Why are hackers returning stolen funds?

At a glance, David Schwed, the chief operating officer of blockchain security firm Halborn, told Blockworks that the alleged black-hat hackers might feel morally obliged to return the stolen funds after being offered a bug bounty.

“[The] hacker [may feel] that they proved the exploit and keeps some of the [money] and justifies it as a bounty and not stolen funds,” Schwed said. 

He also suggested that the attackers may only be returning the stolen funds to remove the pressure and consequences of having their identities revealed. Or it is possible that the exploiters are “truly white-hat hackers trying to shed light on poor security,” though Schwed noted that this thought was “more out there.”

This sentiment was shared by Hugh Brooks, the director of security operations at CertiK, a blockchain ​​security-focused ranking platform. 

Brooks told Blockworks that the past few DeFi hacks should highlight the importance of having proactive bug bounty projects. 

“While some platforms do offer white hat bug bounties to security researchers who willingly disclose vulnerabilities, many do not, which means there is no way for someone with knowledge of a vulnerability to profit from it,” Brooks said.

He noted however that retroactive bug bounties may not always be the solution. 

“A nearly $200 million theft is no small feat. The practicalities of securing, laundering, and selling or spending these funds is daunting, especially to an amateur hacker. Attacks that have been pulled off by professional hacking groups rarely see any funds returned,” Brooks said. “A proactive approach to securing a platform and its users against all forms of cyberattack is essential.”

Although there are ongoing challenges with hacks, Rachel Lin, CEO and co-founder of derivatives protocol SynFutures, believes that the simple fact that exploiters are returning hacked funds “reflects how the crypto ecosystem is evolving to handle the hacks and frauds that have been plaguing our industry.”

“High-profile hacks continue to draw the media’s attention to DeFi’s weakness. Yet it’s also important to acknowledge that the industry is still in its nascent stage. In the near to medium-term, the industry will likely develop more effective strategies to mitigate these risks and protect user funds,” Lin stated. 

In the specific case of Euler, on-chain analysis played a key role in identifying “Jacob” — the alleged attacker — and compelling this person to return the stolen funds, according to Lin.

“This is a great example of how the transparency of blockchain and cryptocurrencies in general make them a less viable option for criminals. That’s unlike fiat, which still accounts for the overwhelming majority of criminal transactions,” she said.

Lin added that, “if governments around the world are willing to work with the crypto industry instead of fighting it, then I’m sure we can effectively deal with illicit activities while also ensuring privacy for everyday users.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates (19).png

Research

Suilend has grown into the top money market and liquid staking provider on Sui. STEAMM, Suilend’s Superfluid AMM, presents a compelling avenue for growing market share within Sui’s DEX landscape and revenue generation for the protocol. Suilend’s multi-product suite position it well for owning market share across key verticals. While current metrics across the Sui ecosystem are likely inflated due to Sui Foundation incentive programs, SEND trades at amongst the lowest multiples in the lend/borrow sector, suggesting that a bull case for continued growth in the ecosystem may be mispriced.

article-image

Silk Road founder Ulbricht made a triumphant return to the Bitcoin Conference, 10 years on from sentencing

article-image

A Blockworks Research report looked at who could take up some of the marketshare in the launchpad space

article-image

Business-to-business stablecoin payments are on the rise, per a report from Artemis, Dragonfly and Castle Island

article-image

Crypto continues to do its thing: incentivizing behavior

article-image

Kraken will soon offer Backed ‘xStocks’ as Solana tokens

article-image

In a unanimous decision, the US Court of International Trade has ruled that Trump’s IEEPA tariffs are unlawful