SIR.trading Founder Pleads with Hacker: Return $255K or Face Collapse

In a desperate plea, the founder of the decentralized finance (DeFi) protocol SIR.trading has publicly begged a hacker to return $255,000 of stolen funds. Xatarrer, the protocol’s pseudonymous founder, issued an on-chain message on March 31st, stating that the remaining funds are crucial for the protocol’s survival. The hack, which occurred on March 30th, saw approximately $355,000 stolen.

Xatarrer’s proposal is simple: the hacker can keep $100,000 as a \”fair share\” for identifying a critical bug, but the remaining funds must be returned. The founder emphasized a desire to avoid legal action and further drama, stating, “We’ll call it even. No legal games, no drama.”

The emotional appeal highlights the vulnerability of smaller DeFi projects. Xatarrer revealed that SIR.trading was bootstrapped with $70,000 from friends and personal savings over four years of development, growing organically to $400,000 in Total Value Locked (TVL) without venture capital investment. They underscored the dire consequences of the hacker keeping all the funds: “If you keep 100% of the funds, there is no chance for us to survive.”

Despite the sophisticated nature of the exploit—which Xatarrer described as \”almost beautiful\”—the lack of response from the hacker and the subsequent transfer of funds through Railgun, an Ethereum privacy solution, paints a grim picture for the future of SIR.trading.

The vulnerability exploited involved a callback function in the protocol’s \”Vault\” contract, leveraging Ethereum’s transient storage feature—a cost-saving measure added in the March 2024 Dencun upgrade. The hacker manipulated the Uniswap pool address in this function, enabling them to redirect funds repeatedly until the entire TVL was drained.

While SIR.trading initially expressed a commitment to continuing operations and support for affected users, the lack of funds makes this future uncertain. The incident serves as a stark reminder of the risks involved in the DeFi space, particularly for smaller projects lacking extensive external funding and security audits.

This event underscores the ongoing challenges of balancing innovation and security in the rapidly evolving DeFi landscape.