Tapioca Foundation Offers $1M Bounty to Attacker Who Stole $4.7M in 'Social Engineering Attack'

The Tapioca Foundation has offered a $1 million bounty to an attacker who stole $4.7 million from its decentralized finance protocol in what it has called

decentralized finance (DeFi) protocol Tapioca has offered a $1 million bounty to an attacker who stole $4.7 million from the protocol in a “social engineering attack.”

In an Oct. 20 onchain message to the attacker’s crypto wallet, Tapioca wrote:

“We would like to begin the conversation around offering you an attractive bounty settlement where you would walk away with funds that are fully legally yours, no strings attached.”

The message adds that the bounty would be paid in Tether (USDT) — “significantly higher than the normal 10%” offered in bounties — in exchange for the attacker returning the remaining $3.7 million.

According to an Oct. 18 X post by Tapioca, the attacker stole 591 Ether (ETH) and $2.8 million in USD Coin (USDC) in the “social engineering attack.”

The attack compromised the ownership of the vesting contract for Tapioca’s Tapioca DAO Token (TAP) and the UDSO stablecoin, the post explained. The attacker was then able to claim and sell vested TAP and “added a minter to infinite mint USDO and drain” a liquidity pool for USDO and USDC.

Tapioca co-founder Matt Marino later stated in an Oct. 19 message on the project’s Discord that fellow pseudonymous co-founder “Rektora” was phished.

“He downloaded something during an interview process and it replaced a transaction with a malicious one. This is how they gained access to the contracts,” Marino added.

In a later Discord post on Oct. 19, Marino also claimed that they had “hacked the hacker and recovered 1,000 ETH,” which was the collateral backing the USDO stablecoin for a liquidity pool.

The attacker withdrew nearly 30 million TAP tokens from the vesting contract in the Oct. 18 attack, according to transactions in their wallet, which were then swapped for about $1.5 million in ETH before being converted into USDT and sent to the BNB Chain, where they still remain.

The attack saw the TAP token lose almost all of its value. It is currently trading at 2 cents, having traded at around $1.40 prior to the attack, per CoinGecko.