Evening
So Crema Finance hacking episode finally got ended happily as hacker returned the stolen fund and kept 20% of the amount as bounty. Crema Finance, a Solana based defi protocol was exploited on 2nd July using a flash loan attack allowing hacker to drain $8.7 million worth of funds.
Crema Finance quickly started negotiations with hacker, offering him a hefty $0.8 million bounty. Finally, the negotiations ended up well with hacker bagging a reward of $1.7 million (45,455 SOL) and returning the remaining $7.6 million. Crema Finance confirmed that the hacker returned 6,064 ETH and 23,967.9 SOL worth $7.6 million in four transactions.
All is well that ends well!
I call this a win win situation. Hacker managed to bag a hefty 0.8 million bounty whereas Crema Finance recovered 80% of their lost funds. Usually stolen funds in these kind of exploits are considered as good as gone, so recovering even of portion of lost funds in indeed a fortuitous.
Some recovery is better than no recovery.
What Crema Finance did good was instead of immediately pursuing law enforcement help they went into negotiations with hacker early and offered him a generous bounty offer. Recent Harmony hack is a perfect example. Harmony offered the hacker a small percentage of stolen funds as bug bounty; 1% and also threatened him with legal action. And as expected, hacker didn't responded and instead started laundered the stolen funds.
I am in no way sympathizing the hackers and implying that the affected parties should go easy on exploiters, but considering the ground realities in these kind of circumstances negotiations should be given a proper chance and generous bounty offers should be made.
Talking about ground realities, the chances of recovering stolen funds using law enforcement channels are always slim due to jurisdictional limitations. So legal course of actions should be adopted as a last resort.
Like it or not, hacks and exploits does require reasonable level 'coding skills and acumen' and those 'skills and acumen' should be acknowledged and appreciated.
What do you think?
