Negotiated bounty (hack return deal)

After an exploit, teams usually send an on-chain message to the attacker's address, publish a deadline and offer a share of the loot, commonly around 10%, in exchange for returning the remainder. If the deadline passes, the offer is typically withdrawn and replaced by a public reward for information leading to an arrest.

These deals exist because recovery through courts is slow and uncertain, while stolen funds can be laundered within hours. Several large exploits have ended with most of the money returned after such negotiations, and the threat of being traced through exchanges and analytics firms gives the offer weight.

The legal status is murky. A protocol or DAO promising not to pursue the hacker cannot bind prosecutors, and paying an attacker may conflict with sanctions rules if the address is linked to a sanctioned group. Critics also argue the practice normalises theft by turning it into a negotiable fee, and some returned-funds agreements were later challenged in court.