22 Aug After breach, hacker culprit asked to sign on as expert adviser

White-hat with a potential job as adviser after their hack

In these trying, uncertain times, using the expertise of cybersecurity experts is a must. How often, though, do we get help from the one’s responsible for the breach? That’s just what happened after the DeFi cyberattack, where a hacker was offered a security position after the fact. It sounds a little crazy, but when you consider it, it’s a smart move.

The breach

For starters, this was no “standard” cyberattack. The party responsible succeeded in what is currently the largest cybersecurity heist, scoring $610 million from PolyNetwork. PolyNetwork is responsible for hosting tokens and allowing users to swap those tokens between blockchain elements. It’s a growing technology and practice, likely one reason it fell victim to the severe cyber-attack.

After the fact, however, the attacker returned the stolen amount. Their reasons were altruistic in nature, they claimed for the project’s good and to ensure its survival. It was also to reveal the numerous vulnerabilities clearly ingrained in PolyNetwork’s security infrastructure. As of now, the hacker has promised to return the full sum, with half returned.

The hacker’s future and moving forward

In this scenario, when a hacker or third party operates for the benefit of an organization or enterprise, they’re referred to as “white hats.” It’s not the same as internal testing or penetration testing, where in-house experts and IT staff sort through a business network to check for weaknesses. A white hat, however, is an ethical hacker, who doesn’t directly work for any enterprise but works to find network vulnerabilities.

PolyNetwork decided to offer a job as to the white-hat for “Chief Security Adviser.” There’s no guarantee said hacker will actually take up the position, but it does posture an interesting relationship between hacker entities and their targets. It is, also, a potential indirect solution to numerous future problems, assuming the right incentives (and ethics) exist.

Consider the primary reason hackers and threat actors operate on: profit. With low risk and cost contrasted with a potential high yield, there’s a big incentive to go after major organizations. But if profit is a motivating factor, does that mean potential threat actors could, instead, work as professionals and/or white-hats to benefit the cybersecurity industry? Obviously, it’s an optimistic notion. One dispenses with any notion of morals or ethics when diving into the dark world of malware/ransomware. Even with the opportunity for stable, high income, it’s no guarantee to sway malicious parties.

Altruist or not?

While it’s a shocking thing that a hacker would act for the benefit of an enterprise, much less return the amount stolen from their efforts, the white hat in this context still holds half of the stolen amount. And while their offer to make good on the return is, time isn’t on the company’s side. The company does have a consumer base, and they’ve struggled to return the stolen amount, even with their good offers towards the hacker.

PolyNetworks have even claimed they will allow the white-hat to keep $500,000 of the stolen amount. Does this mean, however, the “altruistic” hacker will make good on their claims to return the whole stolen sum? Or was it ultimately performative? It’s certainly interesting the full sum wasn’t returned in its entirety. Why hold the rest ransom?

It’s even worth speculating the move by the “altruistic” hacker was done for personal grandeur or fame. There is, absolutely, a deep-rooted romanticism associated with hacking and piracy, given that it can directly inflict monetary pain against wealthy enterprises. Therefore, making headlines to appear moralistic in nature isn’t a far-fetched concept. Just as well, PolyNetwork is in a Stockholm syndrome zone. Of course, they’d want to appease the entity holding all the power, for better or worse.

Still, it’s possible as cyberattacks continue to surge, trying to coax white-hats towards doing some good isn’t an out-of-the-question concept.