Whitehat hacker returns $190K out for $209K to Renegade protocol after exploiting flawed Arbitrum dark pool contract, keeping 10% bounty to avoid legal action

A legacy deployment of Renegade.fi’s on‑chain dark pool on Arbitrum was exploited for roughly $209,000, but the attacker quickly returned about $190,000 after the team publicly offered a 10% “whitehat bounty” and hinted at possible legal action. The incident stemmed from a vulnerable V1 Arbitrum dark pool contract whose deployment and migration process left an initializer/ownership path effectively unprotected, allowing arbitrary logic to be injected into the proxy and used to drain funds. Blockchain security firm Blockaid first flagged the exploit at around 8:27 am UTC, noting that malicious logic had been inserted into a faulty function tied to Renegade’s V1 Arbitrum dark pool, enabling the theft of 27 ERC‑20 tokens worth about $209,000. The attacker moved assets including roughly $84,000 in USDC, $27,885 in wrapped Bitcoin (WBTC) and $23,950 in wrapped Ether (WETH) before sending back more than 90% of the funds—about $190,000—to a Renegade‑controlled Arbitrum address within roughly 45 minutes. In an on‑chain message, Renegade told the attacker to return 90% and keep the remaining 10% as a whitehat reward to avoid potential “civil or criminal action,” an offer the attacker accepted while later criticizing the protocol’s security as “too simple and bad” in a follow‑up on‑chain response. Renegade later attributed the root cause to deployment code that failed to assign an explicit contract owner, combined with a faulty migration introduced in an April 2025 software update, which together allowed anyone to rewrite the V1 Arbitrum dark pool contract. The team stressed that the issue was isolated to this legacy V1 Arbitrum deployment—other deployments such as V1 Base, V2 Arbitrum, and V2 Base remained unaffected—and that only about 7% of the protocol’s trading volume flowed through the compromised pool. Renegade has suspended infrastructure for V1 Arbitrum, pledged full compensation for the small set of impacted users, and promised a detailed post‑mortem and root‑cause analysis, making the case a prominent example of how DeFi protocols increasingly rely on whitehat incentives and rapid on‑chain negotiation to contain smart‑contract incidents.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Renegade recovers $190K after whitehat returns stolen crypto - Bitget (bitget.com)
• White hat returns $190K to Renegade hours after hacking the protocol (tradingview.com)
• Whitehat returns most funds after Renegade exploit - Grafa (grafa.com)
• Renegade says whitehat returned about $190K after $209K ... - BingX (bingx.com)
• Renegade's V1 Arbitrum Exploited, $190K Recovered | Phemex News (phemex.com)

Explore the topic

• USDC
• Arbitrum
• legal
• Hacker