On September 15, 2020, samczsun found a flaw in a Lien Finance contract that held over 25,000 ether14. That ether was worth over $9.6 million at the time. Anyone could mint the contract's tokens for free, then burn them for all of its ether. samczsun chose to rescue the funds. His account of that night, posted on September 24, 2020, is the earliest dated record of the rescue The CryptoLately.com Desk could open17.
samczsun goes by that handle. He later founded the Security Alliance, or SEAL, a nonprofit for crypto security, while he was a researcher at Paradigm47. Its SEAL 911 hotline now lists over $180 million in assets rescued10.
The night of the Lien rescue
Bots were the problem. Front-running bots watch pending Ethereum transactions, copy the profitable ones, and pay more to go first. A public rescue transaction could be copied by those bots, the post says, and turned into the theft it meant to stop1. Going public with a warning carried the same risk, since it would point attackers at the bug.
So the team found a third way. Scott Bigelow, a researcher who studied front-running, joined, and so did auditors who could reach Lien's anonymous team1. The mining pool SparkPool built a private transaction service in about two hours. SparkPool placed the rescue transactions straight into its own blocks, unseen by the bots.
About 15 blocks later, the transactions landed, in order1. Lien's team then withdrew the bulk of the ether itself. “And yet on a late Tuesday night, our unlikely group united under a common cause and worked tirelessly to try and ensure that over 9.6 million dollars would be returned to their rightful owners,” samczsun wrote.
Both sides, in their own words
Can volunteer white hats keep pace with crypto hacks?
“It's noteworthy in trying to solve an incredibly complex problem. And one where if you don't solve the problem, you make it worse”
“Imagine we go to that same guy, and we say instead of $200 million, we'll pay you $10 million. We'll make you famous”
The $350 million morning
His post of August 17, 2021, tells the next big case2. samczsun was reading a Telegram chat about a token sale on MISO, SushiSwap's launch platform. In a little over half an hour, he found a flaw in its auction contract.
The bug let one deposit of ether count many times inside a batch of calls2. A refund rule then paid back any ether above the sale's cap. Together, they could drain the contract. “Today, I'd like to tell you about how I found and helped patch a vulnerability that put over 109k ETH (~350 million USD at today's exchange rate) at risk,” samczsun wrote.
Colleagues reached Joseph Delong at Sushi, who answered within minutes2. Staff from Immunefi, a bug bounty platform, joined the call. The team behind the sale finalized its auction that afternoon, and the immediate threat ended. “All in all, it took only five hours to protect 350 million USD from falling into the wrong hands,” samczsun wrote.
What the coverage missed
The Defiant published an interview with samczsun on March 10, 2020, before either rescue5. Camila Russo's piece cast him as a hero who hunted bugs in his free time for bounties. He was blunt about the pay. “Frankly speaking though most bounties don't offer nearly the same amount of compensation that a hacker could get from just exploiting whatever bug they find,” samczsun said.
What that framing left out was the legal risk of acting. In August 2022, attackers took $190 million from the Nomad bridge6. Many white hats held back, fearing that stepping in could land them in prison, Cointelegraph reported9. samczsun put the problem in one question: “How did we get to a point where random people felt comfortable stealing money from the bridge, but white hats felt it was too risky to intervene.”
SEAL and the safe harbor
The alliance launched formally on February 14, 20246. SEAL had raised more than $1 million in donations by then, Bloomberg Law reported on February 147. Its 911 hotline runs on Telegram, where vetted white hats pick up reports of hacks in progress. SEAL's first reported rescue came in September 2023, when volunteers saved $200,000 from a contract at dice9win.
In mid-February 2024, SEAL released its Safe Harbor Agreement for comment6. A hacked protocol signs it in advance. White hats may then move funds to a recovery address and must return them within 72 hours9. Their reward is 10 percent of the funds recovered, capped at $1 million. In June 2024, SEAL added a legal defense fund for white hats who face lawsuits8.
As of October 13, 2026, SEAL lists over 3,300 tickets handled and over 200 war rooms coordinated10. Its page counts 31 volunteer responders.
The losses they face
Immunefi counted $1,495,487,055 lost to hacks and fraud in 2024, across 232 incidents11. Hacks took $1,467,448,336 of it, in 192 incidents. Fraud took $28,038,719. May was the worst month, when hacks took $356,770,184. Recoveries came to $115,577,966 in 14 cases, or 7.7 percent of the losses.
Hacks took $356,770,184 from crypto users in May 2024, the year's worst month
Dollars lost to hacks and to fraud each month of 2024, by bug bounty platform Immunefi's count
- Lost to hacks
- Lost to fraud
- Height: Lost, US dollars
Source: Immunefi [11].
Read the chart as a table
| Item | Lost to hacks | Lost to fraud |
|---|---|---|
| Jan 2024 | $129,339,800 | $4,072,817 |
| Feb 2024 | $77,551,400 | $4,052,000 |
| Mar 2024 | $126,694,200 | $6,541,000 |
| Apr 2024 | $69,329,627 | $3,277,200 |
| May 2024 | $356,770,184 | $1,753,300 |
| Jun 2024 | $138,139,000 | $3,419,550 |
| Jul 2024 | $277,151,700 | $4,767,552 |
| Aug 2024 | $15,135,000 | $0 |
| Sep 2024 | $126,810,247 | $130,000 |
| Oct 2024 | $73,965,600 | $0 |
| Nov 2024 | $72,711,500 | $25,300 |
| Dec 2024 | $3,850,078 | $0 |
Chainalysis counts theft over a longer span. Its report put 2022 at $3.7 billion stolen, with North Korea-linked hackers taking about $1.7 billion13. For 2023, it counted $1.7 billion stolen. Its revised North Korea figure for that year is $660.50 million, or about $0.66 billion14. Theft reached $2.2 billion in 2024, with $1.34 billion linked to North Korea. From January to early December 2025, over $3.4 billion was stolen, and North Korea-linked hackers took $2.02 billion15.
North Korea-linked hackers took $2.02 billion of more than $3.4 billion stolen in 2025
Crypto stolen each year, total and North Korea-linked, in $ billions; 2025 runs to early December
- All stolen funds
- North Korea-linked
- Height: Stolen, $ billions
Sources: Chainalysis [13]; Chainalysis [14]; Chainalysis [15].
Read the chart as a table
| Item | All stolen funds | North Korea-linked |
|---|---|---|
| 2022 | $3.70B | $1.70B |
| 2023 | $1.70B | $0.66B |
| 2024 | $2.20B | $1.34B |
| 2025 | $3.40B | $2.02B |
The case for white-hat rescues
Miles Jennings, general counsel at a16z crypto, backed the safe harbor in March 2024. “It's noteworthy in trying to solve an incredibly complex problem. And one where if you don't solve the problem, you make it worse,” Jennings told Cointelegraph Magazine6.
samczsun explained his own motive in the same piece. “I've seen people fall victim to spy contract hacks, I've seen people fall victim to individual hacks,” he said6. Rescues inside SEAL's rules now come with a written agreement, a capped reward and a 72-hour return deadline9.
The case against
samczsun's newest essay questions part of the model himself. On December 10, 2025, he argued that bigger bounties leave security to chance. “Higher bug bounties won't stop hacks because it's just doubling down on the gamble that a whitehat will find the bug before a blackhat does,” he wrote3. He urged yearly re-audits.
Immunefi has argued the other side. Its chief executive, Mitchell Amador, described the pitch to a would-be attacker in May 2023. “Imagine we go to that same guy, and we say instead of $200 million, we'll pay you $10 million. We'll make you famous,” Amador said12. In August 2026, Immunefi said its review of 1,178 top-tier audits found a median of zero critical or high-severity bugs16.
Lawyers who helped draft the safe harbor flag a limit too. Since 2022, U.S. policy is to spare good-faith security researchers from prosecution, wrote Michael Bacina and his colleagues at Piper Alderman8. “However, this does not mean that researchers will not face legal threats from the company which published the software or users,” they wrote.
What to watch
SEAL's own counter is the first number to track: over $180 million rescued as of October 13, 202610. Immunefi put 2024 recoveries at 7.7 percent of losses, the measure for whether rescues are gaining on theft11. Chainalysis's next yearly theft count will update the $3.4 billion it found for 202515.
Sources
- samczsun, "Escaping the Dark Forest," samczsun.com, Sept. 24, 2020, https://samczsun.com/escaping-the-dark-forest
- samczsun, "Two Rights Might Make A Wrong," samczsun.com, Aug. 17, 2021, https://samczsun.com/two-rights-might-make-a-wrong
- samczsun, "Higher Bug Bounties Won't Stop Hacks," samczsun.com, Dec. 10, 2025, https://samczsun.com/higher-bug-bounties-wont-stop-hacks
- samczsun, "samczsun (About, Writing and Findings)," samczsun.com, read Oct. 13, 2026, https://samczsun.com/
- Camila Russo, "DeFi Complexity Breeds Attacks, White Hat Superhero Samczsun Says," The Defiant, Mar. 10, 2020, https://thedefiant.substack.com/p/defi-complexity-breeds-attacks-white
- Max Parasol, "'SEAL 911' team of white hats formed to fight crypto hacks in real time," Cointelegraph Magazine, Mar. 27, 2024, https://cointelegraph.com/magazine/seal-911-team-white-hat-forms-fight-crypto-hacks-real-time/
- Muyao Shen, "Crypto Heavyweights Band Together to Support White-Hat Hackers," Bloomberg Law, Feb. 14, 2024, https://news.bloomberglaw.com/ip-law/crypto-heavyweights-band-together-to-support-white-hat-hackers
- Michael Bacina, Steven Pettigrove and Jake Huang, "SEAL launches Legal Defence Fund for Whitehats," Piper Alderman, June 26, 2024, https://piperalderman.com.au/insight/seal-launches-legal-defence-fund-for-whitehats/
- Brayden Lindrea, "Ethical hackers save crypto billions: SEAL's Safe Harbor makes it possible," Cointelegraph, Oct. 1, 2025, https://cointelegraph.com/news/white-hat-hackers-saved-billions-crypto-seal-safe-harbor
- Security Alliance, "SEAL 911," read Oct. 13, 2026, https://www.securityalliance.org/seal-911
- Immunefi, "Immunefi Crypto Losses 2024 Report," read Oct. 13, 2026, https://immunefi.com/blog/research/immunefi-crypto-losses-2024-report/
- Pedro Solimano, "Immunefi CEO's White Hat Pitch: 'None of The Bad Stuff. Instead, You're Going to be a Hero'," Decrypt, May 4, 2023, https://decrypt.co/138771/immunefi-ceos-white-hat-pitch-none-of-the-bad-stuff-instead-youre-going-to-be-a-hero
- Chainalysis Team, "Funds Stolen from Crypto Platforms Fall More Than 50% in 2023, but Hacking Remains a Significant Threat as Number of Incidents Rises," Chainalysis, Jan. 24, 2024, https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2024/
- Chainalysis Team, "$2.2 Billion Stolen from Crypto Platforms in 2024, but Hacked Volumes Stagnate Toward Year-End as DPRK Slows Activity Post-July," Chainalysis, Dec. 19, 2024, https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/
- Chainalysis Team, "North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion," Chainalysis, Dec. 18, 2025, https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/
- Brian Danga, "Crypto lost $110 million to hacks in July amid rising bug bounty activity: Immunefi," The Block, Aug. 10, 2026, https://theblock.co/news/defi/2026-08-10-crypto-hacks-july-immunefi-411246
- Internet Archive, "Escaping the Dark Forest (earliest archived copy, with its original publication time)," captured Sept. 24, 2020, https://web.archive.org/web/20200924174155/https://samczsun.com/escaping-the-dark-forest/