Bribing Hackers Seems to Work: 3 Hacks Returned in 3 Months

A number of DeFi protocols that have suffered attacks over the past year have been able to successfully recover at least part of their stolen funds, due in part to post-attack-negotiated bounty offers.

Most prominently, lending protocol Euler Finance — which was exploited for nearly $200 million in a series of flash loan attacks — saw its hacker return 100% of its recoverable funds. 

“Following successful negotiations, all recoverable funds were returned,” Euler Finance said in a blog post. 

“The return represents one of the largest recoveries of stolen assets in blockchain history,” the company said. “It follows an intensive investigation involving collaboration between security professionals, law enforcement, and community volunteers.”

More recently, liquidity protocol Sentiment also managed to recover $900 thousand of its stolen funds, or around 93% of the total stolen. Sentiment had come to an agreement with the attacker, allowing them to keep $66,000 of the hacked funds.

“As per the terms we will end our investigation into the exploiter’s identity,” the company wrote in a statement posted on Twitter. 

Bridging platform Allbridge, which was drained of $573,000, also ended up in a similar situation.

“1500 BNB was returned to our team. The remaining funds will be considered a white hat bounty to this person,” Allbridge noted in a tweet. 

Why are hackers returning stolen funds?

At a glance, David Schwed, the chief operating officer of blockchain security firm Halborn, told Blockworks that the alleged black-hat hackers might feel morally obliged to return the stolen funds after being offered a bug bounty.

“[The] hacker [may feel] that they proved the exploit and keeps some of the [money] and justifies it as a bounty and not stolen funds,” Schwed said. 

He also suggested that the attackers may only be returning the stolen funds to remove the pressure and consequences of having their identities revealed. Or it is possible that the exploiters are “truly white-hat hackers trying to shed light on poor security,” though Schwed noted that this thought was “more out there.”

This sentiment was shared by Hugh Brooks, the director of security operations at CertiK, a blockchain ​​security-focused ranking platform. 

Brooks told Blockworks that the past few DeFi hacks should highlight the importance of having proactive bug bounty projects. 

“While some platforms do offer white hat bug bounties to security researchers who willingly disclose vulnerabilities, many do not, which means there is no way for someone with knowledge of a vulnerability to profit from it,” Brooks said.

He noted however that retroactive bug bounties may not always be the solution. 

“A nearly $200 million theft is no small feat. The practicalities of securing, laundering, and selling or spending these funds is daunting, especially to an amateur hacker. Attacks that have been pulled off by professional hacking groups rarely see any funds returned,” Brooks said. “A proactive approach to securing a platform and its users against all forms of cyberattack is essential.”

Although there are ongoing challenges with hacks, Rachel Lin, CEO and co-founder of derivatives protocol SynFutures, believes that the simple fact that exploiters are returning hacked funds “reflects how the crypto ecosystem is evolving to handle the hacks and frauds that have been plaguing our industry.”

“High-profile hacks continue to draw the media’s attention to DeFi’s weakness. Yet it’s also important to acknowledge that the industry is still in its nascent stage. In the near to medium-term, the industry will likely develop more effective strategies to mitigate these risks and protect user funds,” Lin stated. 

In the specific case of Euler, on-chain analysis played a key role in identifying “Jacob” — the alleged attacker — and compelling this person to return the stolen funds, according to Lin.

“This is a great example of how the transparency of blockchain and cryptocurrencies in general make them a less viable option for criminals. That’s unlike fiat, which still accounts for the overwhelming majority of criminal transactions,” she said.

Lin added that, “if governments around the world are willing to work with the crypto industry instead of fighting it, then I’m sure we can effectively deal with illicit activities while also ensuring privacy for everyday users.”

---

Get the news in your inbox. Explore Blockworks newsletters:

• Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
• Empire: Start your morning with the top news and analysis to inform your day in crypto.
• Forward Guidance: Reporting and analysis on the growing intersection of crypto and macroeconomics, policy and finance.
• 0xResearch: Alpha directly in your inbox. Market highlights, data, degen trade ideas, governance updates, token performance and more.
• Lightspeed: Built for Solana investors, developers and community members. The latest from one of crypto’s hottest networks.
• The Drop: For crypto collectors and traders, covering apps, games, memes and more.