A hacker stole about $5 million from DeFi protocol Shezmu to return the assets for a 20% bounty.
Shezmu, a yield-bearing protocol, recently experienced a hack, resulting in a loss of about $5 million. However, its team negotiated with the attacker to regain the stolen funds minus a bounty fee.
Fuzzland co-founder Chaofan Shou reported the hack on X, saying, “@ShezmuTech has been hacked / rugged. ~$4.9M worth of $ShezUSD stolen.” He added, “One of their vaults used collateral that can be minted by anyone. With the free collateral, the attacker can borrow an arbitrary amount of $ShezUSD.”
Shezmu confirmed the loss, mentioning one of its ShezUSD vaults had been exploited. It offered the hacker a 10% bounty if they returned the stolen funds. If the hacker did not return the funds, Shezmu would “escalate the matter through legal channels.”
Exploiter Returns Funds
It even left an on-chain message for the hacker – “The Shezmu team is offering a 10% bounty of the exploited funds in exchange for treating this as a white-hat incident as your wallet is Linked to a KYC exchange.” The hacker replied on-chain, demanding a 20% bounty instead of 10%. Shemzu agreed.
The protocol began receiving funds within a few hours, with the hacker returning all the stolen DAI initially. They also returned 282.18 ETH to start with and transferred another 137 Wrapped ETH (WETH).
While the remainder of the funds took some time to return, Shezmu confirmed it has “successfully recovered the remaining funds,” and is “working on a full post-mortem and recovery plan.” It also let users know it will release details about its plans involving returning the assets to Curve, Balancer, and Beefy LPs.
Still, the protocol has not greenlit users to interact with its Oasis vault, which it previously asked them to refrain from.
