United States authorities have unveiled a massive reward for any information provided regarding the management members of the Garantex crypto exchange.

After operating for years and facilitating billions of transactions involving cybercriminals, the now rebranded entity is under heavy fire.

Substantial Reward

The Office of the Spokesperson for the US Department of State issued a statement yesterday, announcing that it is targeting the now-obsolete Russian cryptocurrency exchange Garantex, which was allegedly used by a variety of criminals carrying out cybercrime and money laundering within its network.

The department’s Transnational Organized Crime Rewards Program (TOCRP) has prepared two rewards, totaling up to $6 million, for any information that leads to the arrest or conviction of Garantex executives. This is split between up to $5M for Russian national Aleksandr Mira Serda, co-owner and CCO, and up to $1 million for other key leaders of the exchange.

OFAC, the Treasury’s Office of Foreign Assets Control, is taking steps to redesignate Garantex and designate its successor, Grinex, which remains operational. This followed Tether’s interference, which involved blocking wallets associated with the exchange and seizing USDT assets earlier this year.

German and Finnish authorities also aided by seizing their domain and freezing over $26 million in digital assets controlled by Garantex. OFAC will also be naming three executives from the exchange and six affiliated companies in Russia and the Kyrgyz Republic.

As per reports from the FBI and U.S. Secret Service, between April 2019 and March 2025, the exchange processed at least $96 billion in crypto transactions. It also received hundreds of millions in proceeds from the criminals using it to carry out a range of crimes, including terrorism, drug trafficking, ransoms, and others, oftentimes, causing significant harm to victims from the United States.

Known Facts

Garantex was founded at the end of 2019 and registered in Estonia. Most of its operations were conducted from Moscow and St. Petersburg. In February 2022, it lost its license for providing digital asset services after Estonia’s Financial Intelligence Unit (EFIU) unveiled serious deficiencies in its laws against money laundering and terrorist financing, as wallets linked to criminal activity were discovered.

After the EFIU enforcement and OFAC’s designation, the exchange created an infrastructure designed to prevent institutions from accrediting wallet addresses back to them, in an attempt to evade sanctions. This allowed them to continue providing services to various entities involved in criminal activities.

A known money launderer, Ekaterina Zhdanova, has reportedly funneled over $2 million in Bitcoin to the USDT stablecoin using the exchange. She is currently being pursued under an executive order from November 2023 for conducting financial operations or services in the world’s largest country.

In March 2025, the US DOJ unsealed indictments against the CCO and Aleksej Besciokov, a known executive. Following this, the latter was arrested in India, while the former remains at large.

Security researchers play a crucial role in software development, identifying and discovering vulnerabilities. It’s so important that Apple Security Research runs a Security Bounty Program that offers payouts to researchers for their discoveries. Depending on the severity of the vulnerability, a researcher can make as much as $2 million for spotting a bug, but, as one researcher shows, Apple’s perception of severity doesn’t always make sense.

A researcher who goes by RenwaX23 on X posted about the bounty received for what seems to be a critical security hole. Found in Safari, the hole is a Universal Cross-Site Scripting (UXSS) vulnerability, a type where an attacker can impersonate a user and access their data. In this instance, RenwaX23 demonstrated that the hole can be used to access iCloud and the iOS Camera app. The vulnerability was graded as Critical with a score of 9.8 (on a scale of 10), so it wasn’t a small bug.

Recorded as CVE-2025-30466, Apple fixed it in Safari 18.4, which was released with iOS/iPadOS 18.4 and macOS 15.4 update back in March. RenwaX23 received a fee for the bug discovery–a measly $1,000.

Why the low payout? Some who responded to RenwaX23’s post believe it’s because Apple does consider the ease with which a user could encounter the vulnerability. In this case, “too much user interaction is needed,” as gergely_kalman puts it, to trigger the exploit. Apple’s website states that required user interaction is part of the criteria for determining bounties, along with the number of affected users, level of access, how well the report is written (which affects how much work Apple needs to do), and other factors.

Apple’s website also provides types of vulnerabilities, pay scales, and examples, but as another poster on the thread, Taiko_soup, points out, Apple’s decisions seem arbitrary. Taiko_soup discovered a vulnerability that seemed to have a $50,000 payout, but was offered $5,000.

Security researchers put in several long hours to find holes and report them so that users can have safer software. There seems to be a lack of perspective on Apple’s part to compensate researchers appropriately for the work they do. It doesn’t look good when a company as large as Apple lowballs its payouts.

When Apple releases OS updates, such as the recent macOS Sequoia 15.6 update, they include several security fixes, as detailed on the Apple Security Releases website. On that site, Apple lists the problems that were addressed, and if you look at each specific entry, you’ll see something called a CVE number (which refers to the record kept in the Common Vulnerabilities and Exposures database) and the name of a person or group. That name is a researcher who discovered the vulnerability.

Less than 48 hours after siphoning about $42 million in cryptocurrencies from the decentralized trading platform GMX, the hacker responsible for the attack has begun to return the stolen loot.

According to an update from the on-chain sleuth PeckShield, the GMX exploiter has returned at least $40.5 million in crypto assets, including ether (ETH) and Legacy Frax Dollar (FRAX).

Root Cause of the Exploit

Recall that the hacker exploited GMX’s smart contracts to steal the funds on July 9. A postmortem report from the firm confirmed that it was a re-entrancy attack. The exploiter took advantage of a smart contract function that could not prevent re-entrancy issues within the same smart contract.

This design flaw on GMX V1 enabled the criminal to place multiple calls within one function and caused the contract to calculate the wrong balance. They were able to artificially inflate the price of GLP, which is the liquidity provider token for GMX.

After the breach, they stole several assets, including Wrapped bitcoin (WBTC), FRAX, and DAI. They eventually bridged the funds from Arbitrum to Ethereum and converted all, except FRAX, to 11,700 ETH.

While the hacker made these moves, GMX dropped an on-chain message, offering a 10% white hat bounty in exchange for the stolen funds. The proposal would last for 48 hours, with a promise of no legal consequences.

Hacker Returns Stolen Funds

Earlier today, the hacker responded to GMX’s 10% bounty offering, with a message that read: “Ok, funds will be returned later.” They first returned $10.49 million FRAX to the GMX Security Committee Multisig address. The remaining $32 million, which were swapped for ETH earlier, have also been returned in batches.

Notably, the $32 million ETH was worth $35 million today following the spike in ether’s price. The hacker took the $3 million profit and returned the original amount. Therefore, they took a bounty of roughly $4.5 million and returned a total of $40.5 million.

Meanwhile, GMX has confirmed that the incident did not affect its V2 protocol, as the chain does not have the vulnerability that enabled the attack on V1. The team has lifted the minting caps it placed on liquidity tokens for GMX V2 on Arbitrum and Avalanche.

GMX, the native token of the GMX platform, has also recovered from a sudden dip caused by the incident. Data from CoinMarketCap shows the asset is up over 13% today.

Cetus Protocol posted a $5 million reward on May 23 for information that identifies and leads to the arrest of the attacker who extracted $223 million from its decentralized exchange on the Sui network. 

Announced on May 23, the offer is coordinated with cybersecurity firm Inca Digital and will be funded by the Sui Foundation if the tip proves decisive.

Informants must email the perpetrator’s name, location, and supporting proof with the subject “Cetus lead.” The DEX added that it would withdraw any civil action and cancel the bounty should the exploiter return the assets and accept the earlier settlement proposal.

Notably, the offer comes amid centralization concerns regarding Sui following the freezing of $162 million by many of its 114 validators.

Whitehat offer sets the stage

Hours before the public bounty, Cetus used an on-chain transaction to deliver a separate proposal to the attacker on Sui and Ethereum (ETH) blockchains. 

That note offered a $6 million retention fee, equivalent to 2,324 ETH, in exchange for the return of 20,920 ETH and all frozen amounts on Sui. 

The team said it had mapped the exploiter’s Ethereum wallets and was coordinating with US federal authorities, FinCEN, the Seychelles Police Force, selected defense-sector partners, major exchanges, and bridge operators. 

The ultimatum warned that any attempt to launder funds would trigger a global law-enforcement escalation.

Per the protocol’s May 22 incident disclosure on X, the attacker targeted a flaw in Cetus’ pricing mechanism, prompting an immediate pause of all smart-contract activity. The project’s blockchain data shows that the exploit yielded $223 million in tokens. 

Of that sum, $61 million was moved to Ethereum via bridges, while the remaining $162 million was frozen by Sui network validators.

Cetus has not revealed when normal trading will resume or whether the team will implement code changes before reactivating the contracts.

Validator action sparks decentralization debate

According to its block explorer, Sui hosts 114 active validators. On May 22, Sui stated that a broad plurality agreed to reject any transaction originating from the attacker’s wallets shortly after the breach.

The collective freeze prevented the remaining $162 million transfer and locked the tokens on-chain. 

Gautham Santhosh, co-founder of Polynomialfi, wrote on X that the crypto community is now weighing the benefit of rapid asset protection against the implication that validators can suspend specific accounts at will.

Although he highlighted that the process demanded consensus and was not arbitrary, the episode has changed the security assumptions regarding layer-1 blockchains.

Mentioned in this article

The Ethereum Foundation Bug Bounty Program is one of the earliest and longest running programs of its kind. It was launched in 2015 and targeted the Ethereum PoW mainnet and related software. In 2020, a second Bug Bounty Program for the new Proof-of-Stake Consensus Layer was launched, running alongside the original Bug Bounty Program.

The split of these programs is historic due to the way the Proof-of-Stake Consensus Layer was architected separately and in parallel to the existing Execution Layer (inside the PoW chain). Since the launch of the Beacon Chain in December of 2020, the technical architecture between the Execution Layer and the Consensus Layer has been distinct, except for the deposit contract, so the two bug bounty programs have remained separated.

In light of the coming Merge, today we are happy to announce that these two programs have been successfully merged by the awesome ethereum.org team, and that the max bounty reward has been substantially increased!

Merge (of the Bug Bounty Programs)

With The Merge approaching, the two previously disparate bug bounty programs have been merged into one.

As the Execution Layer and Consensus Layer become more and more interconnected, it is increasingly valuable to combine the security efforts of these layers. There are already multiple efforts being organized by client teams and the community to further increase knowledge and expertise across the two layers. Unifying the Bounty Program will further increase visibility and coordination efforts on identifying and mitigating vulnerabilities.

Increased Rewards

The max reward of the Bounty Program is now $250,000 (paid out in ETH or DAI) for vulnerabilities in scope. Upgrades live on public testnets and targeted for a Mainnet release are also scope, and rewards are doubled during this time, which means that the max reward is$500,000 during these periods!

In total, this marks a 10x increase from the previous maximum payout on Consensus Layer bounties and a 20x increase from the previous max payout on Execution Layer bounties.

Impact Measurement

The Bug Bounty Program is primarily focused on securing the base layer of the Ethereum Network. With this in mind, the impact of a vulnerability is in direct correlation to the impact on the network as a whole.

While, for example, a Denial of Service vulnerability found in a client being used by <1% of the network would certainly cause issues for the users of this client, it would have a higher impact on the Ethereum Network if the same vulnerability existed in a client used by >30% of the network.

Visibility

In addition to the merge of the bounty programs and increase of the max reward, multiple steps have been taken to clarify how to report vulnerabilities.

Github Security

Repositories such as ethereum/consensus-specs and ethereum/go-ethereum now contain information on how to report vulnerabilities in SECURITY.md files.

security.txt

security.txt is implemented and contains information about how to report vulnerabilities. The file itself can be found here.

DNS Security TXT

DNS Security TXT is implemented and contains information about how to report vulnerabilities. This entry can be viewed by running dig _security.ethereum.org TXT.

How can you get started?

With nine different clients written in various languages, Solidity, the Specifications, and the deposit smart contract all within the scope of the bounty program, there is a plenty for bounty hunters to dig into.

If you’re looking for some ideas of where to start your bug hunting journey, take a look at the previously reported vulnerabilities. This was last updated in March and contains all the reported vulnerabilities we have on record, up until the Altair network upgrade.

We’re looking forward to your reports!