How to Negotiate With a Hacker After a DeFi Exploit

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Protocols send an onchain message to the attacker's address offering a bounty, often 10%, for returning the rest by a deadline. Freezes, tracing and law enforcement create the leverage. Screen for sanctions and involve counsel before paying anything.

Watch: How to Negotiate With a Hacker After a DeFi Exploit 1:29

Video transcript

Some attackers give the money back. Poly Network, Euler and Alchemix all recovered stolen funds by talking to the person who took them.

Contain first. A deal needs an attacker you can still message, funds still traceable, no sanctions red flag, and counsel in the room.

Then build leverage. Ask issuers to freeze funds, offer a reward for information, and file with law enforcement early.

Send the offer onchain from a protocol address. State the bounty, the return multisig, a UTC deadline, and what follows a refusal.

Ten percent is the common anchor. SEAL's Safe Harbor framework, written for whitehat rescues, calls it standard in the industry.

Deadlines force a decision. Poly Network got its funds back, Euler reports full recovery, and Curve's group recovered some pools but not all.

A bounty is a payment to the attacker. US persons are generally prohibited from dealing with sanctioned people, and liability is strict. Ask sanctions counsel before paying.

Finally, verify every return onchain, settle only after counsel signs off, put releases in writing, and publish a post-mortem.

Better still, catch the exploit first. Guardian's Managed Security monitors contracts on every block, with a 15 minute SLA on Critical alerts. Read the full guide, or talk to Guardian.

Some attackers give the money back. Poly Network, Euler and Alchemix all recovered stolen funds after talking to the person who took them.

Negotiation is not a plan on its own. It runs alongside containment, freezes and a police report, and works best when those are already moving.

This guide covers the talking. For the first hour, see our DeFi incident response plan.

When Negotiation Makes Sense

Contain first: pause what you can and open a ticket with SEAL 911. Then ask whether a deal is possible.

The attacker is reachable: funds still sit in addresses you can message.
The funds are still traceable: nothing mixed or swapped beyond reach yet.
No sanctions red flag: attribution to a sanctioned group changes everything.
Counsel is in the room: every message may end up as evidence.

Watch for signals. Poly Network's attacker wrote messages embedded in transactions, CNBC reported. Euler's attacker apologized through encrypted messages, per Chainalysis.

Building Leverage

An attacker returns funds when keeping them looks worse than a bounty. Each step below raises the cost of keeping them.

Freeze what can be frozen

Ask issuers and exchanges to freeze what the attacker holds. When Poly Network's hack was announced on August 10, 2021, Tether froze $33 million in USDT, per CoinMarketCap.

Our guide to requesting an exchange freeze covers the evidence to send.

Put a price on identity

A reward for information turns the crowd against the attacker. On March 14, 2023, Euler warned that if 90% of the funds were not back within 24 hours, it would launch a $1 million reward for information.

Curve went further. After its deadline passed, it offered 10% of the remaining funds, then about $1.85 million, for identifying the exploiter in a way that leads to a conviction.

Report to law enforcement

File early. Exchanges such as Binance freeze only on an official order, and a report is the record you want if a sanctions question comes up later.

Making the Offer

Euler and Curve sent their offers onchain, as messages in transactions to the attacker's addresses. Send yours from an address publicly tied to your protocol, and post the same text on your official channels.

A clear offer states:

The bounty: the share the attacker may keep, often 10%.
The return address: a multisig you control, written in full.
The deadline: a date and time in UTC.
What follows a refusal: a public bounty, law enforcement, or both.
What follows a return: only what counsel has approved you to promise.

How much to offer

Ten percent is the common anchor. SEAL's Safe Harbor framework calls 10% "standard in the industry", and SEAL's site lists bounties of 10% of recovered assets, capped at $1 million.

Safe Harbor itself covers whitehat rescues a protocol authorizes in advance, not deals with an attacker. SEAL's site summary says rescued funds must be returned within 72 hours.

Fixed sums work too. Poly Network offered a $500,000 bounty, which the attacker first declined. It then invited the attacker to become its "Chief Security Advisor".

How to word it

Keep the tone flat and factual. Euler's first message, sent the day of the exploit, opened: "We understand that you are responsible for this morning's attack on the Euler platform."

On August 3, 2023, Curve, MetronomeDAO and Alchemix offered a "10% bounty of any stolen funds", per Decrypt. Otherwise, they would pursue the attacker "from all angles with the full extent of the law."

The attacker returned all of Alchemix's funds and 90% of JPEG'd's, The Block reported.

Deadlines and Escalation

A deadline forces a decision. Three cases show the range:

Case	The ask	Escalation	Outcome
Poly Network, Aug 10, 2021	$500,000 bounty	Advisor role offered	Final $141M returned Aug 23
Euler, Mar 13, 2023	Return 90% within 24 hours	$1M information reward	Returns Mar 18 to Apr 3; Euler reports 100%
Curve pools, Jul 30, 2023	Keep 10%, return the rest by Aug 6, 08:00 UTC	Public bounty for identity, about $1.85M	Alchemix in full, JPEG'd 90%; others not

Escalate on schedule. Curve's deadline passed at 08:00 UTC on August 6, and it opened the bounty to the public the same day.

Expect returns in pieces. Euler's attacker sent funds back in tranches between March 18 and April 3, 2023, per Euler's account.

Answer each return. On March 18, after the first funds came back, Euler thanked the attacker and wrote that its reward would be removed and "all our investigations will be dropped."

Sanctions and Law Enforcement

A bounty is a payment to the attacker. If the attacker is sanctioned, it raises the same question as a ransom payment.

OFAC's 2021 advisory is written for ransomware, not exploit bounties. Its general rules still describe the risk:

US persons are "generally prohibited from engaging in transactions, directly or indirectly," with people on the SDN list.
A non-US person's transaction is also prohibited if it causes a US person to violate those sanctions.
Civil liability is strict: a person "may be held civilly liable even if such person did not know or have reason to know" the transaction was prohibited.
OFAC designated North Korea's Lazarus Group in September 2019.

Attribution can arrive fast. The FBI named North Korea as responsible for the $1.5 billion Bybit theft five days after it happened.

For ransomware, OFAC treats a prompt report to law enforcement and full cooperation as significant mitigating factors.

What this means for your bounty is a question for sanctions counsel, before any payment. Screen the receiving addresses, document it, and keep investigators informed.

SEAL's Safe Harbor template takes a similar line. Where a protocol requires named whitehats, they must be screened against global sanctions lists.

Closing and Releases

Verify every return onchain: asset, amount and receiving address.
Settle the bounty exactly as offered, and only after counsel signs off.
Keep public promises, such as withdrawing an information reward.
Put any release in writing, drafted by counsel, who can say what a protocol can promise.
Tell investigators what came back, and keep every message and hash.
Publish the outcome in your post-mortem, using our post-mortem template.

How Guardian Helps

Negotiation starts once detection has failed to stop a loss. Guardian's Managed Security monitors contracts on every block for privileged calls, upgrades, multisig transactions and large fund movements.

When something fires, a Guardian engineer responds, with a 15-minute SLA on Critical alerts. Monitors can include automated pauses.

For outside help during an incident, see what SEAL 911 is and how Safe Harbor works.

Frequently Asked Questions

What bounty do protocols offer hackers?

Often 10% of the stolen funds. SEAL's Safe Harbor framework, written for whitehat rescues, calls 10% standard, and Curve, MetronomeDAO and Alchemix offered 10% in August 2023. Poly Network offered a fixed $500,000 in 2021.

Is it legal to pay a hacker a bounty?

It depends on who receives it and who pays. OFAC says US persons are generally prohibited from dealing with sanctioned persons, and civil liability is strict. Involve sanctions counsel and screen the receiving addresses before any payment.

How do you send a message to a hacker onchain?

Send a transaction to the attacker's address with the message embedded in it, from an address publicly tied to your protocol. Post the same text on your official channels so the attacker can check it is really you.

Should you involve law enforcement when negotiating?

Yes. Exchanges such as Binance freeze only on an official order, and for ransomware OFAC treats prompt reporting and cooperation as significant mitigating factors. Coordinate every offer with counsel and the investigators.

Sources

Catch the exploit before you have to negotiate

Guardian Managed Security watches your contracts on every block, with an engineer on every alert and a 15-minute SLA on Critical alerts.

Talk to Guardian Explore Managed Security