Investigation into the $11.1M Prisma Finance exploit, tracing the attacker's funds and probing the 'whitehat' framing they attempted after the fact.
The Prisma Finance exploit drained $11.1 million from the DeFi protocol. Afterward, the attacker attempted a familiar rebrand: claiming whitehat intent and opening negotiations, while their onchain behavior (mixing funds, moving value away from any plausible return path) told a different story.
The investigation traced the exploit proceeds and scrutinized the gap between the attacker's public posture and their actual handling of the funds. Documenting that gap matters: the 'whitehat after the fact' playbook works only as long as observers can't check the claims against the chain.
The published trail gave the protocol team, exchanges, and investigators a shared factual record of where the money went.
March 2024
Prisma Finance is exploited for $11.1M; the attacker subsequently claims whitehat intent.
April 16, 2024+2 months
Investigation published tracing the proceeds and documenting the mismatch between the attacker's claims and their onchain behavior.
