Worldcoin

Truflation

Bedrock

Shezmu

Crypto liquid restaking protocol Bedrock lost roughly $2 million in a security exploit. In return, the attacker was offered the job of securing the very protocol it stole from.
On Sept. 26, Web3 security firm Dedaub discovered a smart contract vulnerability in multiple uniBTC vaults of Bedrock. According to Dedaub, the bug was disclosed to Bedrock but no action was taken in response to the threat. The security firm added:
<blockquote>
 “Unfortunately, even though we found the issue in the smart contract several hours before, by the time the team responded, the vulnerability had been exploited.”
</blockquote>
The vulnerability was exploited for approximately $2 million loss. However, the attacker had the opportunity to steal up to $75 million from the uniBTC vaults.&nbsp;
<figure><img alt="Hacker behind $2M crypto heist receives job offer from victim protocol" name="" src="https://s3.cointelegraph.com/uploads/2024-09/01923317-450d-702e-801c-d356c66dbaba">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/Bedrock_DeFi/status/1839479965685100780" rel="noopener noreferrer nofollow" target="null" text="null" title="https://x.com/Bedrock_DeFi/status/1839479965685100780">Bedrock</a>
 </figcaption>
</figure>
On Sept. 27, Bedrock acknowledged the hack and said the protocol is developing a reimbursement plan to recoup investors’ losses. Additionally, Bedrock revealed working “with audit teams and white hats to recover the lost funds.”
<h2 id="trying-a-new-approach-to-funds-recovery">Trying a new approach to funds recovery</h2>
Moreover, Bedrock also tried to contact the hacker through an onchain message <a data-ct-non-breakable="null" href="https://etherscan.io/idm?addresses=0x899c284a89e113056a72dc9ade5b60e80dd3c94f,0xee800b1b63893ca1e1b0fa8fefdc10fac9b980f7&amp;type=1" rel="noopener noreferrer nofollow" target="null" text="null" title="null">found</a> on the Ethereum blockchain analytics platform, Etherscan.
<figure><img alt="Hacker behind $2M crypto heist receives job offer from victim protocol" name="" src="https://s3.cointelegraph.com/uploads/2024-09/01923318-49cb-7731-888c-68f03659be1a">
 <figcaption style="text-align: center;">
 Bedrock offers a white hat job to the hacker. Source: Etherscan
 </figcaption>
</figure>
Bedrock asked the hacker:
<blockquote>
 “We would like to communicate with you inviting you to become a white hat for the recent incidence. Would you be interested in working with us and making the protocol more secure?”
</blockquote>
The hacker was also offered a reward for the $2 million uniBTC vault exploit. However, the hacker had not responded to the message at the time of this writing.&nbsp;
The Bedrock team assured users that the existing funds were safe and committed to unpause staking on uniBTC contracts once the vulnerability was neutralized.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/truflation-loses-estimated-5-million-malware-attack" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Coinbase-backed Truflation confirms hack, losses estimated to be $5M</a>
Crypto lender Shezmu recently recovered nearly $5 million from a hacker after a successful onchain negotiation.&nbsp;
<h2 id="negotiating-back-stolen-funds">Negotiating back stolen funds</h2>
After confirming that one of its ShezmuUSD (ShezUSD) stablecoin vaults was exploited, Shezmu proactively urged the hacker to return the funds in exchange for a 10% bounty reward with no legal repercussions.
<figure><img alt="Hacker behind $2M crypto heist receives job offer from victim protocol" name="" src="https://s3.cointelegraph.com/uploads/2024-09/01923319-1f5b-799d-acd4-414d0526b46f">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/ShezmuTech/status/1837257349125525786" rel="noopener noreferrer nofollow" target="null" text="null" title="https://x.com/ShezmuTech/status/1837257349125525786">Shezmu</a>
 </figcaption>
</figure>
However, the hacker responded to the request by demanding a 20% bounty reward instead of the initial 10% offer, which Shezmu agreed to.
<figure><img alt="Hacker behind $2M crypto heist receives job offer from victim protocol" name="" src="https://s3.cointelegraph.com/uploads/2024-09/01923319-6463-7d2d-b1cd-9d0d903065c5">
 <figcaption style="text-align: center;">
 Shezmu’s team negotiates the return of stolen funds with the hacker. Source: Etherscan
 </figcaption>
</figure>
After the blockchain discussion, Shezmu began receiving the stolen Dai (<a data-ct-non-breakable="null" href="https://cointelegraph.com/dai-price-index" rel="noopener noreferrer nofollow" target="_self" text="null" title="https://cointelegraph.com/dai-price-index">DAI</a>) tokens in its wallet. The hacker initially returned 282.18 Ether (<a data-ct-non-breakable="null" href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow" target="_self" text="null" title="https://cointelegraph.com/ethereum-price">ETH</a>) to the protocol and followed it up with another refund of 137 Wrapped Ether (WETH). Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/worldcoin-fined-dmm-bitcoin-system-face-ban-asia-express/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Worldcoin fined again! Crypto store clerk runs off with $500K cash: Asia Express</a>

Hacker behind $2M crypto heist receives job offer from victim protocol

Table of Contents

Cointelegraph

Other articles published on Sep 27, 2024

Wall Street Trader Who Accurately Predicted Solana's $200 Peak In 2024 Now Forecasts a 2,400% Sur...

ADA and DOT Price Charts Load Super Signal for Bullish Upward Movement in the Coming Months, New ...

CZ Released from Custody: Will Bitcoin and Other Cryptos Surge?

Airdrop Update: Tomarket Unveils New Feature

Bitcoin (BTC) Defies September Data with Its Rise! What is the Biggest Reason for the Rise? Analy...

CZ To Walk Out a Free Man Today, Major Turbulence in Crypto Expected

Join our free newsletter for daily crypto updates!