Safe

Arbitrum

Dark

Security

The team behind the Renegade.fi protocol said a whitehat hacker returned about $190,000 after exploiting one of its Arbitrum-based decentralized dark pools and later complying with instructions in an onchain message to return 90% of the funds.
Renegade <a href="https://x.com/renegade_fi/status/2053531772634427599" rel="noopener noreferrer nofollow">confirmed</a> the return of funds on Sunday after blockchain analytics platform Blockaid <a href="https://x.com/blockaid_/status/2053395937708384587" rel="noopener noreferrer nofollow">flagged</a> the <a href="https://arbiscan.io/tx/0x0e494685ace16d372066c5b4db959b58ebac6d88166c2d9d618e0e421dc0c77e" rel="noopener noreferrer nofollow">$209,000</a> exploit at 8:27 am UTC. The hacker injected malicious logic into a faulty function tied to its V1 Arbitrum dark pool to steal 27 ERC-20 tokens.
Data from Arbitrum block explorer Arbiscan shows that the whitehat <a href="https://arbiscan.io/address/0xE4A7cc3049665F686F89d00472f931f6a145CFBE" rel="noopener noreferrer nofollow">returned</a> about $190,000 to the Arbitrum wallet address “0xE4A…5CFBE,” which includes $84,370 worth of USDC (USDC), $27,885 in wrapped Bitcoin and $23,950 in wrapped Ether.
<img alt="White hat returns $190K to Renegade hours after hacking the protocol" height="643" src="https://s3-images.ctmedia.io/media/content/pasted-image-492.png" width="690">Source: <a href="https://x.com/renegade_fi/status/2053531772634427599" rel="noopener noreferrer nofollow">Renegade</a>
White hat hackers have come to play a crucial role in the fight against <a href="https://cointelegraph.com/news/california-man-sentenced-to-78-months-in-250m-crypto-theft-conspiracy" rel="noopener noreferrer nofollow">exploiters</a> who continue to <a href="https://cointelegraph.com/news/12-crypto-protocol-entities-attacked-since-drift-exploit" rel="noopener noreferrer nofollow">exploit crypto protocols</a> despite strengthened security measures in recent years.&nbsp;
Industry initiatives like the crypto security nonprofit Security Alliance’s Safe Harbor framework have been set up to enable white hats to steal funds for <a href="https://cointelegraph.com/news/court-lets-arbitrum-dao-to-transfer-71m-in-eth-tied-to-north-korea-hack-to-aave" rel="noopener noreferrer nofollow">temporary safekeeping</a> while being legally protected.
In an onchain message, Renegade <a href="https://arbiscan.io/idm?addresses=0xf4c75938e590d9095939001e17c67ad86f243d8a,0x777253f28adc29645152b7b41be5c772a9657777&amp;type=1" rel="noopener noreferrer nofollow">asked</a> the hacker to return 90% of the funds and keep the remaining 10% as a “whitehat bounty” to avoid facing potential “civil or criminal action.”
<img alt="White hat returns $190K to Renegade hours after hacking the protocol" height="514" src="https://s3-images.ctmedia.io/media/content/pasted-image-60.jpeg" width="2048">The onchain message that Renegade sent to the hacker. Source: <a href="https://arbiscan.io/tx/0x9c3e0044a133f80adbe7ac21b6a9c1d4c9adc38333283b34873cbf0876986121" rel="noopener noreferrer nofollow">Arbiscan</a>
The white hat hacker sent more than 90% of the stolen funds back within 45 minutes and said in response to the onchain message that the action was taken to protect DeFi users:&nbsp;
<blockquote>
 “I've seen a lot of contempt toward my actions. Although I understand that what I did was not ethical, in the current DeFi cybersecurity, I believe this was the best solution to protect users' funds and ensure their safety.”
</blockquote>
The white hat hacker also hinted that Renegade should tighten up its security measures, stating that the vulnerability exploited was “tooooo simple and bad.”
Related: <a href="https://cointelegraph.com/news/private-key-compromises-led-crypto-hack-losses-decade" rel="noopener noreferrer nofollow">Crypto hackers stole $17B over past 10 years: DefiLlama</a>&nbsp;
<a href="https://cointelegraph.com/news/eth-rangers-program-exposed-100-north-korean-operatives-infiltrating-web3" rel="noopener noreferrer nofollow">North Korean</a> state-backed hackers “would never come to negotiate,” they added.
Renegade said the exploit appeared to have resulted from the deployment code failing to assign an explicit owner and from a faulty migration in an April 2025 software update, enabling anyone to rewrite the smart contract tied to its V1 Arbitrum dark pool.
Dark pools are private trading platforms that allow large trades to occur without exposing their intentions to, or impacting, the broader market.&nbsp;
Renegade added that it would publish a post-mortem with a “full root-cause analysis” explaining the security incident.
Renegade said it would fully compensate affected users, and that only 7% of its trading volume was channeled through the V1 Arbitrum dark pool and that it would contact the “small number of affected users directly.”
Magazine: <a href="https://cointelegraph-magazine.com/exploits-uncovered-by-ai-could-kill-defi-unless-projects-act-now/" rel="noopener noreferrer nofollow">AI-driven hacks could kill DeFi — unless projects act now</a>

White hat returns $190K to Renegade hours after hacking the protocol

Cointelegraph

Other articles published on May 11, 2026

Join our free newsletter for daily crypto updates!