Tapioca Offers $1 Million Reward for Hacker Thief

DeFi protocol Tapioca DAO said that $4.7 million was stolen from it, and to try to get most of the money back, it is now giving a “significantly higher” reward to the person who did it

As part of what it calls a “social engineering attack,” the Tapioca Foundation is offering a $1 million reward to anyone who steals $4.7 million from its decentralized finance system.

Tapioca sent the attacker a message on Oct. 20: “We’d like to offer you an attractive bounty settlement where you would walk away with funds that are fully legally yours, no strings attached.”

It offered $1 million in Tether as a reward, which was “significantly higher than the normal 10%” usually given out. The attacker would have to return the other $3.7 million.

The company said in an Oct. 18 X post that it had “suffered a social engineering attack” in which someone stole 591 Ether and $2.8 million worth of USD Coin.

It said that the attack made owning the sharing contract for its Tapioca DAO Token (TAP) and the UDSO stablecoin impossible.

They could buy and sell vested TAP and “added a minter to infinite mint USDO and drain” a pool of USDO and USDC.

In an Oct. 19 message on the project’s Discord, Tapioca co-founder Matt Marino said that fellow co-founder “Rektora,” who used a fake name, had been phished.

He also said that Rektora “downloaded something during an interview process.” The software then changed a transaction with a bad one, which is how the hackers got into the contracts.

Later, on October 19, Marino said in a Discord post that it had “hacked the hacker” and regained 1,000 ETH worth more than $2.7 million today, which was used to back the USDO stablecoin for a liquidity pool.


Transactions in the attacker’s wallet show that during the Oct. 18 attack, they took out almost 30 million TAP tokens from the vesting contract, traded them for about $1.5 million worth of ETH, turned that into USDT, and sent the money to the BNB Chain, where it is still there.

Because of the attack, the TAP ticket has lost all of its value. CoinGecko says it’s trading at 2 cents right now, down from about $1.40 it was trading at before the attack.