Seneca Protocol Hacker Returns Over $5M Worth ETH From $6.4M Breach

A hacker who gained access to around $6.4 million worth of Ether (ETH) in an exploit of stablecoin protocol Seneca has returned over $5 million after apparently accepting an offer to keep 20% of the stolen funds.

Blockchain security firms CertiK and PeckShield flagged the Seneca exploit Wednesday, warning users about the hack and urging them to revoke approvals from two wallet addresses on the Arbitrum and Ethereum networks.

CertiK’s first alert noted that the exploiter took at least $3 million worth of assets. It was later revealed that over 1,900 ETH, worth around $6.4 million, were lost in the exploit. The blockchain monitoring firm explained that the hacker “transferred assets from addresses that had granted approvals to the vulnerable contracts directly to themself.”

Seneca confirmed that an “approval bug” was detected Wednesday and it was working “actively” with security specialists to investigate the exploit. It also asked users to revoke approvals for a total of six wallet addresses on Ethereum and Arbitrum.

On Thursday, Seneca published its on-chain message to the hacker, whom it called “Whitehat.” The message asked the exploiter to return the stolen funds, threatening “further legal action.” The stablecoin protocol also offered a 20% bounty “as per whitehat efforts.”

Hangzhou-based blockchain security company PeckShield said hours after Seneca’s message, the hacker has returned 1,537 ETH, worth around $5.3 million. The exploiter then moved 300 ETH worth around $1.04 million, or about 20% of the total stolen funds, to two new wallet accounts, it added. Seneca has yet to officially confirm the funds’ recovery, but CertiK has also posted about the funds being returned.

The Seneca exploit comes amid continuing hacking incidents in the cryptocurrency industry, one of the biggest being the exploit of nearly $49 million from decentralized exchange (DEX) KyberSwap.

The DEX was hacked late in November, resulting in losses of $48.8 million in digital assets, including some $20 million worth of Wrapped Ether (wETH). Unlike the Seneca exploiter, KyberSwap’s hacker was much more difficult to deal with as they even threatened to delay negotiations for fund recovery if the DEX pursued threats of legal action.

Earlier this week, PeckShield reported that the KyberSwap exploiter moved almost $2.5 million worth of ETH from Arbitrum to the Ethereum network. It is unclear if the latest movement of funds is related to the DEX’s efforts to the pilfered cryptocurrencies. However, KyberSwap said hours after PeckShield’s report that some users who were affected in the November exploit can start claiming their recovered funds.