Poly Network offers a $500K “bug bounty” to the hacker who returned $340M+ in assets and placed the rest in a wallet jointly controlled by the hacker and Poly
but there's a catch Finextra : Hacker behind $610m crypto heist in line for reward for returning assets Brian Fung / CNN : An anonymous hacker stole $600 million in cryptocurrency, then gave it back Rick Smith / WRAL TechWire : Anonymous hacker returns $600M million in stolen cryptocurrency, rejects reward The Daily Hodl : Hacker Claims $600 Million in Stolen Crypto Will Be Returned, Poly Network Says Final Key Must Be Turned Over Liam Tung / ZDNet : Poly Network hacker has now returned almost all the $600m in crypto taken Tgd Buzz / TGDaily : Hacker behind Poly Network crypto heist did it ‘for fun’ Sead Fadilpašić / Cryptonews : ‘Shall We Play a Game’, Asks Poly Network Hacker Upon Returning the Funds Scott Chipolina / Decrypt : Poly Network Hacker Returns All Stolen Ethereum Assets Vilius Petkauskas / CyberNews : Hacker returns the bulk of the $600 million stolen Tweets: @polynetwork2 : https://twitter.com/... Tom Robinson / @tomrobin : The Poly Network hacker is now saying that they were offered a $500k bounty to return the stolen assets - but that they will not be claiming it. (They have now returned pretty much all of the stolen assets - except the ~$33m in USDT frozen by tether) https://twitter.com/... Eamon Javers / @eamonjavers : Statement from Poly: “We would now like to thank his commitment for helping us improve Poly Network's security and hope he will help contribute to the blockchain sector's continued development upon accepting the Bug Bounty.” Jon Bottarini / @jon_bottarini : Is it really a bug bounty though... or did the “Mr. White Hat” hacker just not want to deal with the pain of illegally laundering millions of dollars worth of cryptocurrency and risk jail time... https://packetstormsecurity.com/ ... #Doubt Alex Hern / @alexhern : hahahaha they're doing the Uber thing https://www.reuters.com/... Alex Hern / @alexhern : The Uber thing: https://www.nytimes.com/... Chris Wysopal / @weldpond : $500K bounty. This must be the biggest ever. Nice going @PolyNetwork2. https://texasnewstoday.com/...
Context & Ripple Effects
Poly Network’s response follows an attack on its cross-chain DeFi protocol that was initially reported at $611M. The attacker then returned more than $256M and later increased the returned amount beyond $342M, making the bounty offer part of an active recovery process rather than a conventional pre-incident vulnerability program.
The key unresolved issue is control of the remaining assets: they sit in a jointly controlled wallet, while the attacker has rejected Poly Network’s $500,000 reward. The episode later culminated in Poly Network reporting full recovery of the stolen cryptocurrency.
First-order effects
- Poly Network regains control of more than $340M in assets and has a recovery channel for the remainder, but still requires the hacker’s cooperation to release funds from the joint wallet.
- The hacker forgoes the offered $500,000 bounty, leaving Poly Network with a public reward offer but no completed handoff of the remaining wallet control.
Second-order effects
- Poly Network’s users face a recovery process tied to the release of the final wallet key, rather than an immediate return of every affected asset.
- By treating the return as eligible for a bounty, Poly Network makes negotiated asset recovery part of its incident response alongside addressing the flaw blamed for the original attack.
Third-order effects
- If repeated across DeFi exploits, jointly controlled wallets and conditional rewards would make attacker cooperation a more formal component of post-hack recovery—while underscoring that protocol security failures can leave restitution dependent on an attacker’s consent.
The trend: DeFi incident response is expanding from preventing exploits to negotiating and technically structuring the recovery of assets after an attack.