The founder of the recently hacked decentralized finance protocol SIR.trading has issued an emotional plea to the attacker

The founder of the recently hacked decentralized finance protocol SIR.trading has issued an emotional plea to the attacker, urging them to return approximately 70% of the stolen customer funds.

The founder of recently hacked decentralized finance protocol SIR.trading has issued an emotional plea to the attacker to return around 70% of the stolen customer funds.

Without the recovery of these funds, the protocol is unlikely to survive.

“Here is my proposal, keep $100k as a fair share for your critical bug find, and return the remaining,” SIR.trading’s pseudonymous founder 'Xatarrer' wrote in a March 31 onchain message to the attacker following the $355,000 hack on March 30.

“We’ll call it even. No legal games, no drama.”

Xatarrer said that SIR.trading was built on the back of four years of late-night coding and $70,000 from friends and believers without any additional venture capital funding.

“It pains me deeply to see you use your skills on this.”

Xatarrer added that they had nothing but respect for the hacker’s skills and that they were welcome to join the SIR.trading team.

“I’m sure you could help us build something amazing.”

Onchain message from SIR.trading founder to the hacker. Source: SIR.trading

The hacker has yet to respond and has already transferred the stolen funds through to Ethereum privacy solution Railgun, according to data from Ethereum block explorer Etherscan.

Xatarrer initially said on March 30 that the SIR.trading team intended to keep the protocol up and running despite the setback. “Those impacted by the hack will not be forgotten,” it said on March 31.

Hack resulted from feature added to Ethereum’s Dencun upgrade

The hacker targeted a callback function used in the protocol’s ‘vulnerable contract' Vault which leverages Ethereum’s transient storage feature.

The hacker managed to replace the real Uniswap pool address used in this callback function with an address under the hacker’s control, allowing them to redirect the funds in the vault to their address by repeatedly calling the callback function until all of the protocol’s total value locked was drained.

The transient storage feature was part of the Dencun upgrade to Ethereum which launched in March 2024 and is designed to offer users lower gas fees than gas typically required for regular storage.

SIR.trading’s documentation shows that it was billed as “a new DeFi protocol for safer leverage” to address some of the challenges that often occur in leveraged trading — such as volatility decay and liquidation risks.

It comes as crypto lost to exploits and scams fell to $28.8M in March, blockchain security firm CertiK said in a March 31 X post.

Around $4.8 million was subtracted from that figure after hackers involved in the 1inch Resolver incident returned the stolen funds.

Crypto exploits and scams had one of their worst months in February, headlined by the $1.4 billion Bybit hack.