The hacker that stole ~$25M worth of cryptocurrency from dForce-based Lendf.Me returns ~$24M through a series of transactions involving different token types
Context & Ripple Effects
This is the reversal of yesterday's story: hackers drained roughly $25M from Lendf.Me, dForce's decentralized lending platform, using what Decrypt reported as a well-known exploit of an Ethereum token (the initial $25M theft). Now nearly all of it is coming back, moved through a series of transactions spanning different token types rather than one transfer.
The return fits an established pattern in this coverage: the CoinDash attacker who took 37K ETH during its ICO later sent back about 30K ETH (the CoinDash return), and the Poly Network and US-government-wallet attackers followed the same script years later. Stolen crypto here tends to boomerang more often than stolen fiat.
First-order effects
- Lendf.Me depositors recover almost their entire balance — roughly $24M of the ~$25M taken — and dForce regains the assets needed to restart its lending platform.
Second-order effects
- The near-full return sets a negotiating template for future DeFi exploits: platforms and their users have leverage to demand restitution when the attacker cannot launder funds quietly, as the CoinDash and Poly Network episodes already demonstrated.
Third-order effects
- If every major exploit ends in a partial or full refund — CoinDash, Lendf.Me, Poly Network, the government-wallet case — the industry's de facto remedy for smart-contract theft becomes on-chain negotiation rather than legal recovery, with white-hat-style returns treated as the expected endgame.
The trend: Public-blockchain traceability is turning large crypto thefts into negotiated restitutions, with attackers returning funds because laundering them is harder than giving them back.