Bribing Hackers Seems to Work: 3 Hacks Returned in 3 Months

Euler Finance, Sentiment and Allbridge have all seen stolen funds being partially returned


solarseven/Shutterstock modified by Blockworks


A number of DeFi protocols that have suffered attacks over the past year have been able to successfully recover at least part of their stolen funds, due in part to post-attack-negotiated bounty offers.

Most prominently, lending protocol Euler Finance — which was exploited for nearly $200 million in a series of flash loan attacks — saw its hacker return 100% of its recoverable funds

“Following successful negotiations, all recoverable funds were returned,” Euler Finance said in a blog post. 

“The return represents one of the largest recoveries of stolen assets in blockchain history,” the company said. “It follows an intensive investigation involving collaboration between security professionals, law enforcement, and community volunteers.”

More recently, liquidity protocol Sentiment also managed to recover $900 thousand of its stolen funds, or around 93% of the total stolen. Sentiment had come to an agreement with the attacker, allowing them to keep $66,000 of the hacked funds.

“As per the terms we will end our investigation into the exploiter’s identity,” the company wrote in a statement posted on Twitter

Bridging platform Allbridge, which was drained of $573,000, also ended up in a similar situation.

“1500 BNB was returned to our team. The remaining funds will be considered a white hat bounty to this person,” Allbridge noted in a tweet. 

Why are hackers returning stolen funds?

At a glance, David Schwed, the chief operating officer of blockchain security firm Halborn, told Blockworks that the alleged black-hat hackers might feel morally obliged to return the stolen funds after being offered a bug bounty.

“[The] hacker [may feel] that they proved the exploit and keeps some of the [money] and justifies it as a bounty and not stolen funds,” Schwed said. 

He also suggested that the attackers may only be returning the stolen funds to remove the pressure and consequences of having their identities revealed. Or it is possible that the exploiters are “truly white-hat hackers trying to shed light on poor security,” though Schwed noted that this thought was “more out there.”

This sentiment was shared by Hugh Brooks, the director of security operations at CertiK, a blockchain ​​security-focused ranking platform. 

Brooks told Blockworks that the past few DeFi hacks should highlight the importance of having proactive bug bounty projects. 

“While some platforms do offer white hat bug bounties to security researchers who willingly disclose vulnerabilities, many do not, which means there is no way for someone with knowledge of a vulnerability to profit from it,” Brooks said.

He noted however that retroactive bug bounties may not always be the solution. 

“A nearly $200 million theft is no small feat. The practicalities of securing, laundering, and selling or spending these funds is daunting, especially to an amateur hacker. Attacks that have been pulled off by professional hacking groups rarely see any funds returned,” Brooks said. “A proactive approach to securing a platform and its users against all forms of cyberattack is essential.”

Although there are ongoing challenges with hacks, Rachel Lin, CEO and co-founder of derivatives protocol SynFutures, believes that the simple fact that exploiters are returning hacked funds “reflects how the crypto ecosystem is evolving to handle the hacks and frauds that have been plaguing our industry.”

“High-profile hacks continue to draw the media’s attention to DeFi’s weakness. Yet it’s also important to acknowledge that the industry is still in its nascent stage. In the near to medium-term, the industry will likely develop more effective strategies to mitigate these risks and protect user funds,” Lin stated. 

In the specific case of Euler, on-chain analysis played a key role in identifying “Jacob” — the alleged attacker — and compelling this person to return the stolen funds, according to Lin.

“This is a great example of how the transparency of blockchain and cryptocurrencies in general make them a less viable option for criminals. That’s unlike fiat, which still accounts for the overwhelming majority of criminal transactions,” she said.

Lin added that, “if governments around the world are willing to work with the crypto industry instead of fighting it, then I’m sure we can effectively deal with illicit activities while also ensuring privacy for everyday users.”

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

MON - WED, MARCH 18 - 20, 2024

Digital Asset Summit (DAS) is returning March 2024. What you can expect: And more! Don’t miss out on the opportunity to be in the room when the future of crypto is decided. Join us and help shape the future of our […]

recent research

Research report - cover graphics-2.jpg


Base has doubled-down on its commitment to the Superchain vision, has shown early signs of success with nearly $400M in TVL, and has become home to novel dapps such as which has seen significant traction.


The SEC, in a Friday court filing, said it reserves its right to object to the plan from Celsius


Largely unnoticed until Monday, stakeholder Justin Sun confirmed a $8 million hack in a tweet


Crypto is that perfect edge for candidates to use to gain votes and campaign dollars


Coinbase can offer crypto custody, crypto buying and selling and crypto trading as part of the registration


The latest industry scandal has rattled Hong Kong’s ambition to become a global crypto hub as its main financial regulator ramps up measures designed to protect investors


Coinbase holds about 5% of the total bitcoin in circulation, according to on-chain analytics firm Arkham Intelligence