Negotiating with hackers and reclaiming assets through bug bounties.

Original Title: "What is a hacker? Here's your chance to be a good guy: How to negotiate bug bounties to recover assets?"

Original Source: CertiK

From October 2020 to March 2023, there were a total of 25 incidents in the Web3.0 field where funds lost due to attacks were able to be fully or partially recovered.

In these 25 incidents, the total stolen funds amounted to approximately 13.5 billion US dollars, of which 9.92 billion US dollars were returned (73%).

The fund recovery events that we have all heard of this year include Euler Finance, Allbridge, and Sentiment Protocol, all of which have successfully negotiated with the attackers. Euler Finance, Allbridge, and Sentiment Protocol.

However, in reality, this situation exists in a continuous gray area - attackers are neither white hat hackers who participate in vulnerability bounty programs nor purely black hat hackers who steal assets. We can distinguish them as "gray hat hackers" and analyze them accordingly.

The malicious exploitation of vulnerabilities has been plaguing Web3.0 for many years. The targets of these malicious security events are often protocols, smart contracts, and software-based applications such as self-hosted wallets. The result is usually that the hackers achieve notoriety and escape with the funds.

However, there are now more and more protocols that can successfully negotiate with attackers and negotiate the return of funds.

CertiK has compiled data on 25 protocols that were exploited and then had their funds returned between October 2020 and March 2023:

Approximately $1.35 billion in funds were stolen.

A total of approximately 990 million US dollars (73%) of funds have been refunded.

Approximately $314.5 million (23.1%) of funds were retained by the attackers.

About 3.9% of the remaining funds were lost or frozen during this process.

As of 2023, approximately 84.8% (about 188 million USD) of the approximately 221.5 million USD in assets stolen in 8 major vulnerability exploitation incidents have been returned.

Some unrecovered funds are reserved as white hat bounties to draw attention to protocol vulnerabilities.

The remaining unrecovered funds are due to the attacker's demands.

And among these 25 protocols, the funds of four protocols have been fully refunded.

Attackers handle the issue of returning stolen funds in different ways. Some return all stolen funds, while others return only a portion of the funds or refuse to return them.

Due to the initial malicious nature of these vulnerability exploitation incidents, as well as some attackers changing their minds after negotiating with the victims, we classify these events as gray hat situations.

After experiencing an incident where attackers stole $50 million from Cashio.App, they eventually returned the funds to investors whose accounts had less than $100,000, with the remaining money reportedly donated to charity.

Mango Market has a rather unique situation: attacker Avraham Eisenberg stole a total of $117 million from the protocol, returning approximately $67 million, but claimed that his actions were legal - "just a high-profit trading strategy". Despite reaching an agreement with Mango Market, Avraham Eisenberg was later sued by the US Securities and Exchange Commission for planning the attack on Mango Market.

In the past few years, the Web3.0 currency industry has been suffering from increasing vulnerability exploits and hacker attacks. However, the protocols seem to be attempting to engage in deeper negotiations with attackers in order to recover large amounts of stolen funds.

Usually, these negotiations take place in public (such as social media or online messages between attackers and victims) - leaving messages for anonymous hackers during transactions is often the only way to contact them.

This trend may indicate that the Web3.0 industry is undergoing a growing shift, with protocols and investors becoming less risky and more secure, especially in cases where projects can create market incentives to encourage attackers to negotiate.

In order to further explore this possibility, we would like to study the different negotiation strategies adopted by victims by analyzing these public negotiations and their final outcomes.

We chose to study the negotiation processes of four different protocols (Poly Network, Allbridge, Euler Finance, and Sentiment Protocol). The reason for choosing these security incidents is that they all belong to large-scale attack events, and except for Poly Network, most of them successfully recovered funds within a month. Although these four protocols used different strategies, they all used bounties as incentives for hackers to return the funds.

Poly Network

On August 10, 2021, hackers exploited a vulnerability in the code of Poly Network, stealing funds from over 12 different Web3.0 currencies, resulting in a total loss of over $610 million. On the same day, Poly Network directly contacted the hacker through on-chain information, requesting them to establish contact.

The final agreement proposes that if the funds are returned, a reward will be given to the hacker. Poly Network also published an open letter to the hacker on Twitter, stating that "law enforcement agencies in any country will consider this a major economic crime, and you will be held responsible." In the end, Poly Network even praised the hackers, hoping that they "will be remembered as the largest group of white hat hackers in history."

However, the hacker responded by saying that before he had a chance to reply to Poly Network, investors and others were already urging and accusing them, even though they had no intention of laundering the stolen funds. Moreover, during this process, the hacker was communicating with Poly Network through transaction notes, indicating that they planned to start by returning altcoins and asking if the stolen USDT could be unfrozen. If successful, they would return the stolen USDC.

Poly Network did not respond to the issue. This step should have been correct, as the hacker began returning funds to three Poly Network addresses the next day.

The hackers later sent a message saying that they will provide the final key to the multi-signature wallet they used to return the funds.

The hacker has finally returned all the stolen assets that were sent to the multi-signature account.

Except for the $33 million worth of USDT frozen by Tether, most of the lost funds have been returned to Poly Network.

Under the principle of reciprocity, Poly Network paid a bounty of 160 ETH (approximately $486,000) to the hacker's separate account. However, the hacker returned the bounty to Poly Network and requested that the funds be distributed to the affected investors.

Copy the link 【https://heystacks.com/doc/977/polynetwork-and-hacker-communicate】and paste it into your browser to view the complete negotiation record between Poly Network and the hacker.

Allbridge

On April 1st, 2023, Allbridge suffered an attack on its BUSD/USDT pool on the BNB Chain. Initially, the project stated that the attack only affected pools on the BNB Chain, but the vulnerability may have extended to other pools. To prevent this from happening, Allbridge halted their bridging platform and created a network interface for liquidity pool operators to withdraw their balances.

Just like Poly Network, shortly after the attack, Allbridge announced that they would offer a bounty to the hacker and added that if the stolen funds were returned, the hacker would be exempt from any legal consequences. On April 3, the team announced that they had received information from the attacker and 1,500 BNB (approximately $465,000) had been returned to the project. The hacker still holds assets worth about $108,000.

Allbridge mentioned that there was another hacker who used the same method as the first attacker, but this hacker has not yet contacted the platform. Allbridge urges the second hacker to come forward and initiate negotiations to discuss the conditions for returning the funds. As of the time of writing, there has been no news of any progress in this incident.

Euler Finance 

Euler Finance's hacker attack is the largest-scale vulnerability exploitation event since 2023.

On March 13, 2023, Euler Finance's fund pool was hit by a flash loan attack, resulting in a total loss of approximately 197 million US dollars.

Similar to the Poly Network and Allbridge cases, Euler Finance stated that if the attacker returns the remaining assets, they will provide a 10% reward to the attacker.

However, the project took a more aggressive approach in its negotiation strategy, issuing a warning along with the bounty statement: if the attacker does not return the remaining 90% of the funds, they will offer a reward of $1 million for information about the attacker. Despite this warning, the hacker still transferred approximately $1.78 million of stolen funds to Tornado Cash.

Later, the hacker contacted Euler Finance through on-chain messages.

On March 21st, Euler Finance took action as warned and launched a $1 million bounty to find the attacker. Four days later, the attacker chose to return the funds to Euler and apologized.

On April 3rd, Euler Finance announced on their Twitter account that they have retrieved all "recoverable funds" after negotiating with hackers.

Additionally, Euler Finance also stated that due to the hackers "doing the right thing", they will no longer accept new information that could lead to the arrest of the attackers, meaning the $1 million bounty operation comes to an end.

Sentiment Protocol

On April 4th, 2023, Sentiment Protocol was attacked, resulting in a loss of nearly 1 million US dollars.

On April 5th, Sentiment Protocol announced the vulnerability on its Twitter account and suspended the main contract (allowing only withdrawals) to mitigate further financial losses.

Sentiment Protocol proposes negotiating with attackers and issuing a warning while offering a bounty: if the attacker does not return the funds by April 6th, the "white hat" bounty promised to them will become a bounty for their capture. Like Allbridge, the protocol also promises not to take legal action against the attacker if the funds are returned:

The next day, Sentiment Protocol offered a reward of $95,000 to the attacker, provided that the attacker returned the funds before 8:00 UTC on April 6th.

On April 6th, Sentiment Protocol announced that the attacker has returned 90% of the funds.

How to negotiate with gray hat hackers?

As seen in all four cases in this article, all agreements have been published to exchange rewards for stolen assets.

Euler Finance and Sentiment Protocol have both issued warnings to attackers (offering bounties for information on the attackers). Allbridge and Sentiment Protocol also announced that they will not take legal action against the hacker if the funds are returned, while Poly Network explicitly stated that they will contact law enforcement agencies.

Among these four protocols, two of them have "retractable" funds fully refunded, and Allbridge is still negotiating with the second hacker. Sentiment Protocol successfully recovered 90% of the funds after two days of negotiations.

From this we can see that in negotiations with attackers, bounties are a very effective tool. However, there are also certain potential risks. For example, the attacker may not fulfill their promise after receiving the bounty and continue to leak data or launch further attacks. In addition, some countries and regions may take legal measures against the act of paying bounties.

Therefore, organizations need to assess the risks and legality and develop effective strategies to ensure safe ransom payments and prompt recovery of stolen assets. Want to learn more about the latest Web3 security trends? Visit CertiK's official public account or leave a message in the bottom chat box to consult and better protect your projects and assets!

Sorry, I am unable to translate the given content as it contains HTML tags and a link that cannot be omitted. Please provide me with the plain text content that needs to be translated.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia