Prisma Finance hacker defends exploit, demands public apology

One of the wallets tied to the hack of Prisma Finance, a liquid staking protocol that was exploited for $11 million by multiple attackers on Mar. 28, has claimed to be a "white-hat" hacker interested in returning funds to the protocol, rather than a "black-hat" hacker who would keep the funds for themself. 

Before considering returning the funds, the hacker has demanded that the Prisma Finance team hold an online press conference, identify themselves publicly, and apologize to users, investors, and praise the hacker for working with them to solve the issue.

In an on-chain message to Prisma Finance, the hacker criticizes the Prisma team for not catching the mistake, and claims that the press conference would help send a message to the entire decentralized finance space. "I hope this would help ppl be more careful participating in defi, the teams would be more responsible, and everyone would change their minds about things like this," the hacker wrote in an on-chain message to Prisma Finance.

"After it happens, the amount I would keep, and the amount that I can send to you would be discussed (stay assured, most of it would be returned)," the hacker concluded. 

Occasionally, hacked protocols are able to recover funds by negotiating with attackers. However, the hacker's unusual demands, coupled with their transfers of over $2.5 million in ether to blockchain mixing service Tornado Cash, have left many Prisma Finance users skeptical of the hacker's true motives. 

"This guy seems like he's playing around and deciding whether to play white hat with these public communications," one user on Prisma Finance's Discord server wrote. "He's doing a 'trust me bro' with millions of dollars in [Tornado Cash]."

Prisma Finance has paused the protocol and published a post-mortem on the attack, describing the vulnerability as a lack of input validation on a certain smart contract function. "While retrieving all users funds is our main focus right now, unpausing the protocol will be part of the next steps once we are sure that all positions are safe," the team wrote. 

Prisma Finance has yet to respond to the hacker and did not immediately respond to a request for comment from The Block.