Kronos Research negotiates with hacker over $26m theft

November 28, 2023

Taiwan-based trading firm Kronos Research has initiated talks with a hacker who stole $26 million from the firm’s treasury earlier this month.

Taking to Etherscan, Kronos is offering the hacker a bounty of 10% after $25 million was taken in a Nov. 18 breach.

Kronos Research negotiates with hacker over $26m theft - 1 — Kronos offers 10% bounty for return of stolen crypto | Source: Etherscan

The attack took place after an unauthorized party accessed Koronos’s API keys.

Onchain analysts ZachXBT and Lookonchain confirmed the theft noting that the majority of the $25 million stolen assets were in stablecoins.

Kronos later commented, “we can confirm that the losses are about $26 million in crypto assets, and despite it being a sizable amount, Kronos remains in good standing. All losses will be covered internally, and no partners will be affected.”

Hackers continue to plague the crypto space

Data from DefiLlama indicates that in 2023 cybercriminals inflicted losses exceeding $1.2 billion on crypto companies and decentralized finance (DeFi) protocols through 81 separate hacks.

Blockchain security firm Certik attribute these and other incidents to a variety of causes including protocol exploits, exit scams, private key compromises and Oracle manipulation.

One of the most notable incidents this year involved the Mixin Network in Sept., where hackers managed to extract $200 million in what was one of the year’s largest exploits.

Another significant breach occurred at Stake.com, with losses amounting to $41.3 million, ranking it among the top 10 hacks of 2023.

In a similar situation to Kronos, Curve Finance offered a 10% bounty this past August for the return of $52 million in hijacked crypto, which, it should be noted, was also negotiated through transaction signing.

The hacker responsible for the Curve Finance theft did not comply with the deadline set for returning the misappropriated assets. Consequently, the affected parties decided to offer a public bounty. They announced a reward equivalent to 10% of the unrecovered funds, $1.85 million. That bounty — which is still available — will be granted to anyone who can successfully identify the exploiter and help lead to their arrest.