> ## Content Index
> Fetch the complete content index at: https://wire.fourthweb.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hacker Returns $11M After Keeping $2.8M Bounty in Rare White Hat Deal
- URL: https://wire.fourthweb.ai/hacker-returns-11m-after-keeping-2-8m-bounty-in-rare-white-hat-deal/
- Published: 2026-05-22T10:30:44.000Z
- Updated: 2026-05-22T10:30:45.000Z
- Description: The bridge attacker just proved that white hat bounties work better than threats, keeping 25% of the haul as payment for finding the hole. An exploiter returned 4,052.4 ETH ($8.5M) to Verus bridge on Friday, keeping a $2.8M bounty as part of a negotiated recovery deal.
- Author: Travis Wright
- Tags: Real World Assets, Tokenized Assets, DeFi, Ethereum

**The bridge attacker just proved that white hat bounties work better than threats, keeping 25% of the haul as payment for finding the hole.**

### The Summary

- [An exploiter returned 4,052.4 ETH ($8.5M) to Verus bridge](https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth?utm%5Fsource=rss&utm%5Fmedium=rss) on Friday, keeping a $2.8M bounty as part of a negotiated recovery deal.
- [The return represents 75% of stolen funds](https://cointelegraph.com/news/verus-bridge-hacker-returns-85m-eth-28m-bounty?utm%5Fsource=rss%5Ffeed&utm%5Fmedium=rss&utm%5Fcampaign=rss%5Fpartner%5Finbound), with the protocol offering the bounty framework days after the exploit.
- The deal sets a precedent: pay attackers to return funds rather than chase them through the courts or lose everything.

### The Signal

[The Verus bridge team did something](https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth?utm%5Fsource=rss&utm%5Fmedium=rss) most protocols only threaten to do. They made an explicit offer: return most of the money, keep a bounty, no questions asked. The attacker took it. Friday's onchain transfer of 4,052.4 ETH back to Verus wallets confirmed what might become the new normal for DeFi security incidents.

[The 75% recovery rate](https://cointelegraph.com/news/verus-bridge-hacker-returns-85m-eth-28m-bounty?utm%5Fsource=rss%5Ffeed&utm%5Fmedium=rss&utm%5Fcampaign=rss%5Fpartner%5Finbound) matters more than the optics of paying an exploiter. Most bridge hacks end with total loss. Poly Network got funds back in 2021\. Nomad bridge recovered almost nothing. Ronin lost $600M and spent years in legal battles. Verus just cut the cycle short.

> "The protocol negotiated a recovery deal days after the incident rather than months of legal theater."

The math is stark:

- Total exploit: roughly $11.3M
- Returned: $8.5M
- Bounty retained: $2.8M (about 25%)
- Recovery rate: 75% in less than a week

Compare that to the industry standard. According to Chainalysis, less than 20% of DeFi exploit funds are ever recovered. Most attackers just tumble through mixers and vanish. Verus flipped the incentive. They turned the exploiter into a very expensive penetration tester.

### The Implication

This sets a template. If you're running a bridge or DeFi protocol, you now have proof that bounty frameworks work faster and cheaper than forensics firms, legal teams, and public shaming campaigns. The question is whether 25% becomes the standard rate or if protocols start negotiating lower. Expect more teams to pre-announce bounty policies before exploits happen, turning post-hack chaos into a known decision tree.

For users, this changes the risk profile slightly. Bridges are still the weakest link in cross-chain infrastructure, but recovery odds just improved. Watch how other protocols respond. If Verus gets praised for this instead of criticized for paying a hacker, you'll see copycats within the quarter.

### Sources

[RWA Times](https://rwatimes.substack.com/p/verus-bridge-exploiter-returns-4052) | [CoinTelegraph](https://cointelegraph.com/news/verus-bridge-hacker-returns-85m-eth-28m-bounty?utm%5Fsource=rss%5Ffeed&utm%5Fmedium=rss&utm%5Fcampaign=rss%5Fpartner%5Finbound) | [The Block](https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth?utm%5Fsource=rss&utm%5Fmedium=rss)