Prisma Finance, a decentralized finance (DeFi) firm, revealed that there is still $540,000 in funds remaining from accounts that have not yet revoked the smart contract responsible for the recent $11.6 million exploit. The hacker behind the exploit, self-identified as a "white hat," stated that they will not return the funds until Prisma Finance publicly apologizes and discloses the identity of their team online.
In a post outlining the way forward on April 1, a core contributor known as "Frank" emphasized the importance of retrieving the funds and unpausing the protocol. However, they highlighted that safety measures for users' wallets and positions must be ensured first. The exploit occurred as a result of two MigrateTroveZap contracts, designed to transfer user positions between trove managers, as explained in a post-mortem update provided by Prisma on March 31.
Despite efforts, 14 accounts are yet to revoke the affected smart contract, with five of them still considered "at risk," totaling over $500,000 in open trove positions. Prisma Finance operates as a decentralized borrowing protocol through "troves," which represent Ethereum addresses where users can manage and obtain loans.
As Prisma works towards recovering the stolen funds, a proposal was made on April 1 to reduce liquidity from POL and staked revenue from vePRISMA. The exploited contract is separated from the core protocol, with plans to reactivate it once all user funds are deemed secure.
The person behind the exploit is demanding that Prisma publicly identify their team and issue an apology. They insist that the funds will not be returned until these steps are taken, and they have asked Prisma to host an online conference for this purpose. Prisma responded by asserting that the exploiter has not shown any good faith either by not returning any funds yet.
Security firms have noted that the hacker started converting the stolen funds into Ether after the attack, including transferring some Ether to Tornado Cash, a cryptocurrency mixer that is under OFAC sanctions. Before the exploit, Prisma Finance had $220 million in total value locked, but this figure has dropped to $87 million post-attack, as reported by DefiLlama.
