KyberSwap hacker offers $4.6M bounty for return of $46M loot

A hacker who stole $46 million from decentralized exchange KyberSwap has been offered a 10% bounty reward for the return of the stolen funds. KyberSwap has set a deadline of 6 am UTC on November 25 for the return of 90% of the loot.

Hacker compromises KyberSwap Elastic

On November 23, KyberSwap alerted users that its liquidity solution, KyberSwap Elastic, had been compromised and advised them to withdraw their funds. The hacker made off with approximately $20 million in Wrapped Ether (wETH), $7 million in wrapped Lido-staked Ether (wstETH), and $4 million in Arbitrum (ARB) tokens on November 22. The stolen funds were then spread across multiple chains, including Arbitrum, Optimism, Ethereum, Polygon, and Base.

Hacker leaves on-chain message

After hiding the stolen funds, the hacker left an on-chain message addressed to KyberSwap developers, employees, decentralized autonomous organization members, and liquidity providers. The message stated, "Negotiations will start in a few hours when I am fully rested."

KyberSwap responds with an offer

After a day of silence, KyberSwap responded to the hacker's message, requesting the return of 90% of the stolen funds. The team acknowledged the hacker's skills and proposed a bounty equivalent to 10% of the users' funds for the safe return of all the funds.

Deadline for response

If the hacker fails to respond or return the funds by 6 am UTC on November 25, KyberSwap has warned that they will remain on the run. However, the team is open to further discussion with the hacker via email.

Expert analysis of the hack

A decentralized finance (DeFi) expert has analyzed the recent KyberSwap hack and believes that the attacker used an "infinite money glitch" to drain the funds. Ambient exchange founder Doug Colkitt explained that the hacker relied on a "complex and carefully engineered smart contract exploit" to carry out the attack. The same exploit was used against other KyberSwap pools on multiple networks, resulting in a total loot of $46 million.