Tapioca offers $1M bounty to attacker after $4.7M DeFi hack

Decentralised finance protocol Tapioca DAO (CRYPTO:TAP) has offered a $1 million bounty to the attacker who stole $4.7 million in a recent "social engineering attack."

In an onchain message sent on October 20 to the attacker’s wallet, Tapioca proposed a settlement in exchange for the return of $3.7 million of the stolen funds.

The offer includes $1 million in Tether (USDT), which the foundation described as “significantly higher than the normal 10%” bounty typically offered in such cases.

The attack, disclosed on October 18 via X (formerly Twitter), resulted in the theft of 591 Ether (CRYPTO:ETH) and $2.8 million worth of USD Coin (USDC).

The hacker compromised the vesting contract for Tapioca DAO Token (TAP) and the USDO stablecoin, allowing them to mint unlimited USDO and drain liquidity pools for USDO and USDC.

Tapioca co-founder Matt Marino explained in the project's Discord that fellow co-founder “Rektora” was phished during an interview process.

Marino stated that Rektora downloaded a malicious file that led to the attackers gaining access to the vesting contracts.

This allowed the hacker to withdraw nearly 30 million TAP tokens, which were converted into $1.5 million worth of ETH.

These funds were later transferred to the BNB Chain (CRYPTO:BNB).

Despite the significant loss, Tapioca managed to recover 1,000 ETH (around $2.7 million) from the attacker.

Marino revealed in an October 19 Discord message that the team had “hacked the hacker” and regained part of the stolen funds.

However, the remaining funds still sit in the attacker’s wallet on the BNB Chain.

Tapioca’s $1 million bounty offer is an attempt to retrieve the remaining funds and end the incident on a positive note for both parties.

At the time of writing, the Tapioca DAO Token price was $0.01597.