The tweet was deleted by the author.
But we saved everything 🙂.
A hacker exploited an old deployment of the Renegade V1 protocol on Arbitrum, draining approximately $209,000 in 27 different tokens. Hours later, the attacker returned about $190,000—roughly 90% of the stolen funds—after the team made a public on-chain appeal.
The attack targeted a vulnerable dark pool in the outdated V1 Arbitrum deployment. The hacker used a malicious logic in a faulty function to extract the assets. Following an on-chain message from the Renegade team offering the attacker 10% as a “white hat” reward in exchange for returning 90%, the majority of the funds were sent back to the project’s wallet.
Renegade confirmed that the vulnerability affected only the old V1 version on Arbitrum. All other deployments—including V1 on Base and both V2 versions — remain secure. The team has suspended the vulnerable infrastructure, and there is no ongoing risk to user funds.
All affected users are expected to receive full compensation. Blockchain security firm Blockaid and other researchers tracked the incident, noting that the hacker acted quickly after the team’s direct appeal.
The returned assets included significant amounts of USDC, wrapped Bitcoin, and wrapped Ether.
The Renegade V1 incident stands out as a relatively rare example in decentralized finance where a significant portion of stolen funds was voluntarily returned. It demonstrates that direct communication with attackers can sometimes lead to positive outcomes, even in anonymous blockchain environments.
The event also serves as a reminder of the persistent risks associated with legacy smart contract deployments and the importance of timely deprecation of old protocol versions.
We have previously highlighted that crypto industry lost over $600M to hacks in April.