MSTR Cat

Crypto Law/Level VI · Market conduct/6.2 Insiders and rugs/Lesson 7

Bounties, white hats and negotiated returns

What a bug bounty, a post-hack ‘bounty’ offer and a whitehat safe harbour can and cannot do legally, and why a protocol cannot promise anyone immunity from prosecution.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Builders: publish a bug-bounty and disclosure policy before launch; it costs only the reward you choose, and the Justice Department’s 19 May 2022 policy says good-faith research should not be charged under the CFAA. Catch: that policy binds federal prosecutors only.
  2. Adopt the SEAL Whitehat Safe Harbor through governance at no licence cost: rescuers send funds to your Asset Recovery Address for a recommended 10% reward and you waive claims. Catch: it cannot cover government action, and disputes default to SIAC arbitration.
  3. After an exploit, an on-chain offer settles only your protocol’s own claims. Never offer silence toward police, as Ahmed proposed, and never promise immunity from prosecution, which no private party can give.
  4. Researchers: move funds only with written authority that clearly covers you, and report any reward as income, since the SEAL summary makes the whitehat responsible for taxes. Demanding payment or control for a return can be charged as attempted extortion.

MaterialsThe Justice Department’s May 2022 policy on charging cases under the Computer Fraud and Abuse ActThe SEAL Whitehat Safe Harbor Agreement and its summary (Security Alliance, on GitHub)The US Attorney’s April 2024 release on Shakeeb Ahmed’s sentenceLessons 5.3.5 (smart-contract audits) and 6.2.6 (hacks and exploits as theft)

Wonder

  1. If a protocol pays a hacker a ‘bounty’ to return funds, is the hacker then in the clear?
  2. Is it legal to rescue funds from a protocol while someone else is draining it?
  3. What makes a negotiation after a hack turn into extortion?

Explore

  1. Three different things share the word ‘bounty’. A bug bounty is a published reward for reporting a vulnerability before anyone exploits it. A whitehat rescue is when a security researcher moves funds out of a contract that is already being attacked, to keep them safe. A negotiated return is an offer, usually made on-chain after an exploit, letting the attacker keep a share if the rest comes back. Legally they differ sharply. The first two can be authorised in advance by the protocol; the third is a deal with someone who has already taken the money.
  2. The Poly Network exploit of 10 August 2021 set the pattern. An attacker moved about $610 million out of the cross-chain protocol, then began returning it. Poly Network called the attacker ‘Mr. White Hat’ and offered a $500,000 bounty as part of negotiations, while Tether froze about $33 million of USDT. By late August the attacker had given back access to the remaining funds. Calling the attacker a ‘white hat’ was a negotiating choice by the victim, not a legal finding. Euler Finance’s 2023 recovery, covered in lesson 5.3.5, followed a similar path.
  3. The Ahmed case shows how prosecutors view such bargaining (lesson 6.2.6). After his first exploit, Shakeeb Ahmed offered to return all but $1.5 million if the exchange agreed not to refer the attack to law enforcement. Nirvana Finance offered him a bug bounty of up to $600,000 to return its funds; he demanded $1.4 million, no deal was reached and he kept everything. Prosecutors described both episodes in announcing his three-year sentence. In the KyberSwap case, prosecutors allege that Andean Medjedovic demanded control of the protocol and its DAO in exchange for returning about half, and charged attempted extortion.
  4. For research before any attack, the Justice Department changed its policy on 19 May 2022. Federal prosecutors are directed not to charge good-faith security research under the Computer Fraud and Abuse Act, meaning access solely to test, investigate or fix a flaw, done in a way designed to avoid harm, with the results used mainly to improve security. The policy warns that claiming to do research is not a free pass: finding vulnerabilities in order to extort their owners is not good faith. It binds federal prosecutors only, not states, foreign governments or private plaintiffs.
  5. For rescues during an attack, the Security Alliance (SEAL) publishes a Whitehat Safe Harbor Agreement that protocols adopt through governance. It covers only active exploits started by someone else; the whitehat must send recovered assets to the protocol’s designated Asset Recovery Address. SEAL recommends a 10% reward, which a protocol may adjust or cap. If the whitehat complies, the protocol and its users waive claims against them. The summary is explicit that the agreement does not and cannot cover government or regulatory action. Disputes go to arbitration, by default in Singapore under SIAC rules.
  6. For builders, a practical check is to publish a disclosure and bounty policy before launch and decide whether to adopt a safe harbour, so researchers know the rules in advance. After an exploit, any offer works only as a private settlement of the protocol’s own claims. Ahmed’s proposed condition, silence toward the police, did not protect him, and demanding control or payment as the price of a return can be charged as attempted extortion, as in the KyberSwap case. Researchers, for their part, should not touch funds without written authority that clearly covers them. The SEAL summary also makes the whitehat responsible for any taxes the rescue creates.

Key facts

  • On 10 August 2021 an attacker took about $610 million from Poly Network and later returned it; during the negotiations Poly Network offered a $500,000 bounty.
  • After an exploit in July 2022, Shakeeb Ahmed offered to return all but $1.5 million if the exchange agreed not to refer the attack to law enforcement.
  • Nirvana Finance offered Ahmed a bug bounty of up to $600,000; he demanded $1.4 million and kept all the funds.
  • On 19 May 2022 the Justice Department directed that good-faith security research should not be charged under the Computer Fraud and Abuse Act.
  • The SEAL Whitehat Safe Harbor Agreement applies only to active exploits started by someone else and recommends a 10% reward, which protocols may adjust or cap.
  • The SEAL Safe Harbor summary states that the agreement covers the protocol and its users but does not and cannot cover the actions of government or regulatory entities.

Exercise nine, six, three, one

9CollectList up to 9 terms a protocol might set in a bounty or safe-harbour policy, or in an offer to an attacker (some lists are shorter), such as a reward percentage, a deadline or a return address.
6ClusterSort them into 6 categories: what is covered, how much is paid, how funds are returned, deadlines, legal waivers, and conditions that could be risky.
3DistillReduce the 6 categories to 3 groups: terms set before any attack, terms offered only after an exploit, and terms no private party can lawfully promise.
1CrystallizeWrite 1 sentence explaining, in your own words, why a protocol can waive its own claims against a hacker but cannot promise that the hacker will not be prosecuted.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS