The Tapioca Foundation has extended a $1 million bounty offer to the hacker responsible for a devastating $4.7 million theft from its decentralized finance (DeFi) protocol. The foundation issued an on-chain message on October 20, addressing the attacker directly and proposing a settlement with an incentive.

Tapioca’s bounty, offered in Tether (USDT), is far more generous than the typical 10% rate seen in similar situations, aiming to entice the hacker into returning the remaining $3.7 million.

The breach occurred on October 18 when the foundation revealed it had suffered a “social engineering attack,” resulting in the loss of 591 Ether (ETH) and $2.8 million in USD Coin (USDC). The attacker exploited the vesting contract for Tapioca DAO Token (TAP) and its USDO stablecoin, seizing control of the assets and draining liquidity pools in the process.

Hack Recovery Efforts

The Tapioca Foundation believes the attack was initiated through a phishing scheme targeting one of its co-founders. According to Matt Marino, co-founder of Tapioca, a fellow co-founder known as “Rektora” downloaded malicious software during an interview process. This software allowed the attacker to replace a legitimate transaction with a malicious one, ultimately granting access to sensitive contracts.

The attacker withdrew approximately 30 million TAP tokens from the vesting contract, swapped them for $1.5 million worth of ETH, and converted that into USDT. The funds were then sent to the BNB Chain, where they remain, as shown by transactions in the attacker’s wallet.

Tapioca Recovers $2.7M from Attacker’s Collateral

The Tapioca team managed to “hack the hacker.” On October 19, Marino shared on the project’s Discord that they had recovered 1,000 ETH, worth over $2.7 million, from the collateral backing the USDO stablecoin.

While this recovery represents a partial victory for Tapioca, the TAP token’s value has plunged since the attack. Once trading at $1.40, the token has now crashed to just 2 cents.

The foundation’s unusual bounty offer remains open, though the attacker’s intentions and next steps are still unclear. Tapioca’s move is yet another reminder of the risks associated with DeFi protocols, even as teams scramble to mitigate such threats.

The post Tapioca Foundation Offers $1M Bounty After $4.7M DeFi Hack appeared first on TheCoinrise.com.