A white hat hacker helped Foom Cash recover most of the funds stolen in a $2.26 million exploit, underscoring the growing role of ethical hackers in Web3 incident response.
Foom Cash, a decentralized, anonymous lottery protocol based on zero-knowledge proofs, was <a href="https://x.com/Foomclub_/status/2028231845788188747" rel="noopener noreferrer nofollow">exploited</a> for $2.26 million in funds.
The intervention of an ethical hacker helped the protocol recover $1.84 million, or 81% of the stolen funds, Foom Cash announced on Monday.
Pseudonymous white hat hacker Duha identified the vulnerability and secured funds on Base before malicious actors could exploit them, while Decurity handled recovery efforts on Ethereum, the protocol said in a Monday <a href="https://x.com/Foomclub_/status/2028231845788188747" rel="noopener noreferrer nofollow">post</a> on X.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-03/019cae56-7c74-75b0-92cd-b41af677b20b.png" title="" alt="White hat helps recover $1.8M after $2.3M Foom Cash exploit">
 <figcaption>Source: <a href="https://x.com/Foomclub_/status/2028231845788188747" rel="noopener noreferrer nofollow">Foom Cash</a>
 </figcaption>
</figure>
Foom Cash awarded the white hat hacker a $320,000 bounty, while crypto security platform Decurity was awarded a $100,000 security fee.
”By honoring their bug bounty policy, @foomclub_ has proven that they take protocol security seriously and value the researchers helping them,” <a href="https://x.com/duha_real/status/2028272537864724666" rel="noopener noreferrer nofollow">wrote</a> white hat hacker Duha, in response to the incident.
Related: <a href="https://cointelegraph.com/news/suspected-insider-1-2m-zachxbt-axiom-expose" rel="noopener noreferrer nofollow">Suspected insider wallets rack up $1.2M betting on ZachXBT’s Axiom exposé</a>
<h2 id="fatal-deployment-oversight-led-to-2-2-million-exploit">”Fatal deployment oversight”&nbsp; led to $2.2 million exploit</h2>
The $2.26 million exploit stemmed from a “fatal” deployment error involving a missing command-line interface (CLI) step during the Phase 2 trusted setup process.
”In Groth16, if you skip the circuit-specific contribution setup in snarkjs, the parameters γ (gamma) and δ (delta) remain set to the same default value (the G2 generator),” wrote Foom in a Monday X <a href="https://x.com/Foomclub_/status/2028231849374367860/photo/1" rel="noopener noreferrer nofollow">response</a>.
This deployment error enabled the attacker to trick the protocol into ”accepting forged proofs because a placeholder was never randomized.”
<figure><img src="https://s3.cointelegraph.com/uploads/2026-03/019cae56-7f11-7456-8b8d-0b096aedebd8.png" title="" alt="White hat helps recover $1.8M after $2.3M Foom Cash exploit">
 <figcaption>Source: <a href="https://x.com/Foomclub_/status/2028231849374367860/photo/1" rel="noopener noreferrer nofollow">Foom Cash</a>
 </figcaption>
</figure>
<h2 id="white-hat-hackers-to-the-rescue">White hat hackers to the rescue</h2>
White hat interventions have become an increasingly common feature of DeFi incident response, particularly as exploiters move quickly to bridge funds across chains or into privacy tools.
In August 2023, white hat hacker and Paradigm researcher Samczsun established a team of ethical hackers known as SEAL (Security Alliance), surpassing <a href="https://cointelegraph.com/news/ethical-hackers-alliance-crypto-hack-protection" rel="noopener noreferrer nofollow">900 hack-related</a> investigations within their first year, Cointelegraph reported.
The initiative came nearly a month after a hacker stole over <a href="https://cointelegraph.com/news/indian-crypto-exchange-wazirx-hack-235m" rel="noopener noreferrer nofollow">$230 million from WazirX</a>, an Indian cryptocurrency exchange, in the second-largest cryptocurrency hack of 2024.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-03/019cae56-8123-70d9-b258-9b64445a20f4.jpg" title="" alt="White hat helps recover $1.8M after $2.3M Foom Cash exploit">
 <figcaption>SEAL Whitehat Safe Harbor Agreement. Source: Security Alliance
 </figcaption>
</figure>
On Feb. 10, 2026, the <a href="https://cointelegraph.com/news/ethereum-foundation-seal-partner-stop-wallet-drainers" rel="noopener noreferrer nofollow">Ethereum Foundation partnered</a> with SEAL to create a ”Trillion Dollar Security” initiative to combat crypto wallet drainers.<iframe src="https://www.youtube.com/embed/t06mVWz6ngM?start=" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/inside-30000-phone-crypto-airdrop-bot-farm/" rel="noopener noreferrer nofollow">Inside a 30,000 phone bot farm stealing crypto airdrops from real users</a>

White hat helps recover $1.8M after $2.3M Foom Cash exploit

Table of Contents

Cointelegraph

Other articles published on Mar 2, 2026

Join our free newsletter for daily crypto updates!