Last week, TransitFinance was exploited by multiple hackers who made off with nearly $23 million in ETH, Binance-pegged ETH, and BNB.

Since then, the project – which collaborated with PeckShield and other blockchain security firms – stated that it had tracked the attackers and knew, with relative certainty, who they truly were. Most funds have since been returned, with TransitFinance promising to prosecute the hackers who refuse to transfer back theirs.

TransitFinance Accused of Being Insincere

Following TransitFinance’s promise to prosecute those who did not return the funds, the main hacker left a message for the team asking for a larger bounty before initiating a TornadoCash transfer for a portion of the stolen amount.

“I don’t believe you because you are not sincere. I only exploited eth and bsc chains. […]With reference to past Nomad and Wintermute events, I should get a higher bounty than what I get now. It’s hard not to suspect that this is your official backdoor, and you should be happy that the exploit was done by me and no one else.”

It appears that the team at TransitFinance has indeed reached out to the hacker and hashed things out, according to a recent update.

Return of Stolen BNB in 2 Phases

In the update, TransitFinance stated that for the past week, the team had been engaged in friendly communication with the most prominent hacker – now referred to as “white hat #1”. As a result of said close communication, white hat #1 will keep a bigger bounty than initially offered, and TransitFinance users will get their funds back.

The white hat hacker promised to refund 6,500 BNB as soon as possible, with a further 3,500 BNB to be refunded once TransitFinance initiates the second phase. If funds are not transferred back by the 12th of October, TransitFinance plans to take legal action against any stragglers.

As a reward for their cooperation, the white hat hacker will retain a bounty of 2,500 BNB. TransitFinance has stated that if they keep their word, no further action will be taken, and they will be absolved of all legal responsibility.

The update ends with a list of addresses belonging to unresponsive exploiters, who – according to the team at TransitFinance – will be prosecuted to the full extent of the law if they do not return the remaining funds by the 12th of October.