Hacker Exploits Vulnerability, Then Negotiates Onchain

A white hat hacker who exploited a vulnerability in Renegade.fi’s Arbitrum-based dark pool over the weekend returned roughly $190,000 in stolen crypto assets just 45 minutes after the protocol publicly offered a bounty deal onchain.

The attacker initially drained around $209,000 worth of assets after exploiting a faulty function tied to Renegade’s V1 Arbitrum dark pool, according to blockchain security firm Blockaid, which first flagged the exploit.

The exploit allowed the attacker to inject malicious logic into the protocol and siphon off 27 ERC-20 tokens, including approximately $84,000 worth of USDC, $27,000 in wrapped Bitcoin (WBTC), and $23,000 in wrapped Ether (WETH).

Shortly after the exploit, Renegade sent a public onchain message directly to the attacker, offering a familiar DeFi truce: Return 90% of the funds, keep 10% as a white hat bounty, and avoid potential civil or criminal action.

The hacker accepted the offer and returned more than 90% of the stolen assets within the hour.

“Too Simple and Bad”

In a follow-up onchain response, the attacker defended the exploit as an attempt to protect users before more dangerous actors could discover the vulnerability.

“This was the best solution to protect users’ funds and ensure their safety.”

The attacker also sharply criticized Renegade’s security practices, describing the vulnerability as “tooooo simple and bad” while warning that state-backed groups such as North Korean hackers “would never come to negotiate.”

Renegade later confirmed the exploit stemmed from deployment code that failed to assign explicit ownership permissions, combined with a faulty migration introduced during an April 2025 software update. The mistake effectively allowed anyone to rewrite the smart contract governing the V1 Arbitrum dark pool.

The incident highlights the increasingly unusual dynamic emerging across decentralized finance, where protocols sometimes negotiate directly with hackers in public view to recover stolen funds before they disappear permanently.

Rather than immediately laundering stolen assets, many white hat hackers now exploit vulnerable protocols temporarily to expose weaknesses and secure user funds before malicious actors can strike.

Industry initiatives such as the Security Alliance’s Safe Harbor framework have further formalized this process by offering legal protections for ethical hackers who responsibly return exploited funds.

Renegade Says User Funds Will Be Repaid

Renegade said only around 7% of its trading volume flowed through the compromised V1 Arbitrum dark pool and stressed that the number of affected users remained relatively small.

The protocol added that all impacted users would be fully compensated and promised to release a detailed post-mortem explaining the root cause behind the exploit and the security failures that allowed it to happen.

The exploit may have ended peacefully, but it also exposed how a relatively simple deployment mistake nearly compromised an entire DeFi trading system. In the end, Renegade avoided a catastrophic loss not because the protocol was fully secure — but because the attacker chose to act like a negotiator instead of a thief.