DeFi Protocol Sturdy Finance Offers $100K Bounty To Attacker In $800K Exploit

DeFi Protocol Sturdy Finance Offers $100K Bounty To Attacker In $800K Exploit

Decentralized lending protocol, Sturdy Finance, has offered a $100,000 bounty to the attacker who drained nearly 442 Ethereum (ETH), worth $800,000 from the platform on June 12.

Emerging New Trend

Over the past few months, an interesting emerging trend has been observed after an exploit wherein hackers have begun returning ill-gotten funds in exchange for a clean chit from the law and a sizeable bug bounty reward from the project developers.

However, it still does not serve as a foolproof scheme to retrieve the lost funds. In some instances, the hackers oblige, returning some of the hacked funds while in other instances, the negotiation remained unsuccessful.

Recently, the decentralized finance (DeFi) platform Jimbo’s Protocol offered 10% of the exploited funds as a bounty and threatened the hacker with a prosecution. In another incident, Euler Finance announced a $1 million bounty on the hacker who stole almost $200 million from the DeFi platform, earlier this year. There have been a lot of instances when crypto companies and project developers have offered substantial bounties to recover their lost funds. 

Emerging New Trend in hacking and exploits

Bounty To Recover Lost Funds

In the latest development, Sturdy Finance has extended a $100K bounty in an attempt to redeem its exploited $800K. On June 13, Sam Forman, the project’s founder confirmed in a tweet that his team had sent an on-chain message to the unknown attacker’s address, offering the bounty in order to return the stolen funds to a specified address owned by Sturdy.

As per the tweet, Forman has asked the hacker to contact a provided email which belongs to Sturdy Finance, if he is willing to discuss other conditions. In addition, the exec also said that the team will “advocate for no criminal charges” if the funds are returned. Forman tweeted,

“As we have seen with recent hacks, exploits are not as easy to escape from as they used to be. That said, we are willing to offer you $100k as a bounty, and will not pursue you further if you send the remaining funds to 0x4e489d9863c9bAAc6C4917E1221274760BA889F5.”

This comes shortly after Sturdy Finance was hacked on June 12, resulting in a loss of approximately $800K. As per blockchain security firm Peckshield, the hacker exploited a vulnerability that eventually manipulated a faulty price oracle, allowing them to drain funds from the protocol.

Bounty To Recover the Lost Funds of Sturdy

However, on further investigation, Peckshield highlighted the root cause of the exploit was primarily due to the defective price oracle to compute the cB-stETH-STABLE asset price. The security firm also confirmed that the attacker was able to transfer almost $800,000 in ETH to the crypto mixer Tornado Cash.

Almost an hour later, the DeFi protocol said that they were aware of the exploit and responded by pausing all their markets and assuring its users that no additional funds were at risk. The team reassured users that no other funds were at risk and that the platform’s security would be thoroughly investigated.

Hackers Agree To Return Exploited Funds

Several crypto-focused organizations have managed to recover a substantial amount of lost finds through bounty programs in the past few months. In April alone, there were at least three incidents of hackers returning exploited funds in the decentralized finance (DeFi) space. On April 4, the Euler Finance team was able to recover $176.4 million after offering the hacker 10% of the stolen funds.

Similarly, lending protocol Sentiment was able to recover almost $1 million in stolen funds after negotiating with its hacker. More recently, the attacker who was able to take $8.9 million from DeFi protocol SafeMoon agreed to return 80% of the funds.

It seems the prospect of making a good chunk of money without having authorities track them down is a good prospect for hackers. Also, as enforcement agencies beef up their act, hackers may be forced to return ill-gotten funds for fear of being identified and arrested.