A Grey Area: Retroactive Bug Bounty Negotiations

CertiK analyzes 25 Web3 protocol exploits (Oct 2020–Mar 2023) that collectively saw about $1.35B stolen and ~$992M returned following negotiations. The report examines negotiation tactics and outcomes using four recent large incidents (Poly Network, Allbridge, Euler Finance, Sentiment Protocol), highlights use of on-chain messages and bounties to recover funds, and notes that negotiation incentives and public communication can materially increase recoveries.