After a hacker exploited a validation flaw in Seneca’s smart contract, pilfering over $6.4 million in cryptocurrencies, the stablecoin protocol has responded by offering a 20% reward for the return of the stolen assets. The breach, which took place on February 28, was initially believed to have resulted in a $3 million loss. However, further inspection revealed that the hacker had absconded with around 1,900 Ethereum. Multiple blockchain security firms, including CertiK, flagged the incident and called upon network users to revoke permissions from the compromised Ethereum and Arbitrum addresses.
The Incident Rundown
The exploit stemmed from a vulnerability within the contract’s code, enabling the hacker to issue external calls to any address. The inability of Seneca’s contracts to freeze operations in such an event added to the gravity of the situation, urging users to withdraw their permissions. Seneca has since been working with specialists to probe the breach and has promised a $1.2 million reward to the hacker for the restoration of the funds.
A Negotiated Solution
In a bid to recover the stolen assets, Seneca broadcasted a communiqué on February 29, urging the hacker to return 80% of the pilfered assets to a designated Ethereum address, effectively allowing the perpetrator to retain the remaining 20%. The team behind Seneca collaborated with security experts and law enforcement in tracking the stolen funds and urged the hacker to comply to prevent legal repercussions.
In a turn of events, the hacker returned approximately 1,537 Ethereum, worth about $5.3 million, shortly after Seneca’s plea. Keeping the agreed-upon 20% bounty, amounting to nearly $1 million, the hacker then dispersed the remaining Ethereum to two other addresses, thus concluding the unexpected negotiation.