KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter

The shadowy hacker behind last week’s massive $48 million drain of decentralized finance (DeFi) market maker KyberSwap has finally listed their demands: nothing short of complete control of the company, forever. 

The exploiter, who now apparently has embraced the moniker “Kyber Director,” wrote an open, on-chain letter sent via an Ethereum transaction Thursday requesting Kyber’s leadership hand them the keys to the 100-plus person company. 

Among the hacker’s particular demands: the surrender of complete executive control over Kyber Network, the company behind KyberSwap; full (“temporary”) authority over the company’s governance DAO; access to all internal company documentation pertaining to Kyber’s structure, revenue, operations, expenses, salaries, investors, assets, and liabilities; and forfeiture of all assets under the company’s control, ranging from tokens, shares, and equity to creative and intellectual property in the form of social media channels, blogs, and websites. 

In return for this king’s ransom, the hacker has promised to become Kyber’s new, benevolent overlord, and guide the company into a new dawn. That new regime would see company executives banished outside the castle walls, to make way for a new age. They would, according to the hacker, be bought out of the company at a “fair valuation.”

“You will be wished well in your future endeavors,” the hacker wrote. “You haven’t done anything wrong…. Simply bad luck.”

Current non-executive employees, meanwhile, would purportedly not only be retained—but see their salaries doubled. 

“It is understandable many employees will want to leave regardless,” the exploiter wrote of expected ramifications of their installment as Kyber’s sole ruler. “The employees who don’t want to stay will be given a 12-month severance with full benefits and assistance in finding a new career, no questions asked.”

Kyber Network currently has at least 117 employees, according to LinkedIn, ranging from data scientists and engineers to graphic designers, marketing specialists, and office administrators. The company is based in Singapore.

As for Kyber Network token holders, and investors—they should only rejoice, according to the hacker. 

“Under this treaty, your tokens will no longer be worthless,” “Kyber Director” declared. “Is this not sweet enough? I’ll go further: under my management, Kyber will undergo a complete makeover. It will no longer be the 7th most popular DEX, but rather, an entirely new cryptographic project.”

While Kyber’s management may not be inclined to surrender their company to the anonymous individual who took it hostage, they find themselves in a particularly tough spot.

The KyberSwap protocol currently has just $7.17 million in total value locked, according to DefiLlama. Prior to last week’s hack, and the company’s following advisement that users withdraw funds from the vulnerable platform, that figure sat at $86 million.

The company’s leadership has until December 10 to accept the hacker’s offer, according to today’s letter. At that point, “the treaty falls through.” Should any government entity contact the hacker, the deal will also fall through, and no Kyber employee or executive will receive any of the stolen funds, according to the note. 

Decrypt reached out to both Kyber Network and the hacker regarding the state of negotiations, but did not immediately receive a response from either party. 

The hacker ended their ransom letter on a somewhat cheery note, by emphasizing that they don’t want to see Kyber go under, and that they respect its stature as a long-running DeFi project. 

In the meantime, they can be reached on Telegram at the address @Kyber_Director.

Edited by Andrew Hayward