KyberSwap offers 10% bounty to hacker following $47 million exploit

The Block

Decentralized exchange protocol KyberSwap offered a 10% bounty to the hacker who executed an exploit leading to the loss of $47 million.

The attack, which occurred earlier this week, targeted KyberSwap’s Elastic pools, compromising funds across multiple blockchains including Arbitrum, Optimism, Ethereum, Polygon, and Base.

The perpetrator had previously left a message on the blockchain suggesting an interest in negotiating with the team. The message stated: “Dear Kyberswap Developers, Employees, DAO members, and LPs, negotiations will start in a few hours when I am fully rested. Thank you.”

Today, KyberSwap proposed a deal. In an on-chain message, the team offered an implied white hat bounty reward equal to 10% of the stolen funds (roughly $4.7 million) on the basis that the hacker returns the remaining 90% to a specified address by 6 am UTC on November 25.

Ultimatum to the attacker

In the message, KyberSwap co-founder Victor Tran said the hacker can return the funds or "stay on the run."

The bounty offer is part of KyberSwap’s efforts to mitigate the consequences of the incident and make liquidity providers whole. Security firm Beosin explained that the vulnerability that resulted in the attack was due to an issue with the tick interval boundaries on Kyber's liquidity pools. This enabled the hacker to artificially double the liquidity, which they were then able to drain.