Whitehats, Blackhats, and the Blurred Line in Web3

Web3 hacks have become commonplace. In 2025 alone, over $3.4 billion was stolen from the industry (mostly by the Lazarus Group), and attacks with over $1 million in losses occur on a near-weekly basis.

One of the reasons for this is likely that there are few consequences for carrying out major hacks in the space. Many Web3 hacks remain unprosecuted.

Another challenge is the difficulty in differentiating between cybercriminals and "whitehat" hackers carrying out attacks. The two types often look the same on-chain, and projects often work hard to blur the lines.

The Types of Web3 Hackers

Web3 protocols can be targeted by hackers with varying intentions. On the one hand, you have attackers like the Lazarus Group, which unrepentantly exploit protocols for gain. Most stolen value (mainly from large, centralized crypto services) is attributed to this sophisticated threat actor.

At the other extreme, you have attackers operating with the best of intentions. Blockchain's immutability means that hacks are often (but not always) irreversible, and security researchers may exploit a protocol and steal funds to prevent someone else from doing so first. Occasionally, attacks may be motivated by frustration, if a whitehat can't reach the team behind a protocol or their warnings are ignored.

Between these two extremes is a significant gray area. In some cases, automated bots may detect a high-value transaction (i.e. a hack) and front-run it, stealing funds that are later returned. An attacker might also exploit a protocol and have a change of heart, returning the bulk of the funds.

Bug Bounties (Deliberately) Blur the Lines

A 10% bug bounty has become a key component of many protocols' incident response playbook. A (non-binding) offer of immunity from prosecution and a smaller payout rarely works out for protocols.

In 2025, about 13.2% of stolen funds were returned or frozen, meaning that even less were actually returned and accessible to the protocol. However, there are always a few exceptions that inspire the rest to keep trying (Poly Network, GMX V1, etc.).

This practice does more harm than good for Web3 security. Protocols relying on a bounty payment after an incident (rather than focusing on prevention) are going to be disappointed, and whitehat hackers might not take the risk of exploiting a protocol to save it without knowing that immunity and a payout are on the table. On the other side, cybercriminals can carry out hacks knowing that they have a fallback option if they can't cash out cleanly.

Security Should Be Proactive and Preventative

Security has long been a problem in Web3. While the "test in prod" mentality has largely fallen by the wayside, many Web3 hacks are entirely preventable if security best practices were followed.

Instead of relying on post-exploit bounty payouts, Web3 projects should focus on identifying and proactively closing security gaps. And, if they want to offer a bounty as a fallback, look into SEAL's Whitehat Safe Harbor, which preauthorizes 10% bounties with a default cap of $1 million for whitehat rescues with funds returned within 72 hours.

Educational content, not legal, financial, investment, or professional security advice. Terms