Huobi Reclaims $8 Million In Stolen Ethereum After Offering Bounty to Hacker

Huobi Gloabl’s cryptocurrency exchange has recovered millions in stolen funds from a hacker who absconded with them in September after making contact with the attacker and negotiating a deal to see it returned. 

Justin Sun, a Huobi Global investor and HTX adviser, took to Twitter on Saturday to announce that $8 million in stolen Ether (ETH) was restored and that the hacker made “the right choice” to accept HTX’s offer.

“We have confirmed that the hacker has fully returned all funds, as promised, and we have also paid the hack a white hat bonus of 250 ETH,” wrote Sun in a post. “Providing full security for user assets is always our goal to strive for!”

HTX first disclosed the hack on September 25 after one of the exchange’s hot wallets was compromised and drained of 5,000 ETH.

At the time, Sun assured customers that the amount was a “relatively small sum” versus what he said was HTX’s $3 billion in assets. Sun also said at the time that HTX would offer 5% of the stolen ETH as a “white-hat reward” to encourage the hacker to return the funds—but warned that the firm would contact law enforcement if the offer wasn’t accepted within a week.

Crypto firms have sometimes found themselves left negotiating with hackers to get stolen funds back rather than turning to law enforcement agencies for help. In more than one of these deals, the firm and the hacker were able to reach an agreement in which the bulk of the funds are restored, and a bounty is then paid to the hacker to close things out.

Hacks against cryptocurrency exchanges are a persistent risk, but the types of exchanges targeted have differed. 

In the second quarter of 2023, there was a 63% increase in blockchain hacks compared to the same time last year, according to an Immunefi report from July. The company also found that most of the hacks happened on DeFi platforms, which lost $228 million across 79 incidents. By comparison, centralized exchanges—like HTX—only lost a reported $37 million across two incidents.