A hacker who stole $340 million in a crypto heist has returned the majority of the funds, according to a TechCrunch report on the incident.

The reversal stands out in a sector where stolen crypto assets are rarely recovered. Chainalysis and other blockchain forensics firms have repeatedly documented that only a small fraction of funds taken in major exploits is ever returned, whether through negotiations with security firms, white-hat bounty arrangements, or law enforcement action.

Details of how the attacker executed the initial theft, and what prompted the partial return, were not specified in the report. The episode nonetheless fits a recurring pattern in crypto security incidents: exploiters sometimes return funds after protocols deploy negotiation teams, offer bug bounties, or when public blockchain records make laundering the proceeds operationally difficult.

The $340 million figure places the incident among the larger crypto thefts recorded to date. For the affected platform, the partial recovery materially reduces the balance-sheet hole left by the exploit, though any unrecovered portion still represents a direct loss that the entity will need to absorb, reimburse from reserves, or socialize across users — a decision that carries its own operational and reputational costs.

The incident also underscores the dual-use nature of blockchain transparency. Because stolen funds move through traceable addresses, attackers face persistent pressure at every cash-out point, from centralized exchanges to mixing services. That traceability has become a core tool for on-chain investigators and has contributed to several high-profile voluntary or negotiated returns in past years.

Whether the remaining funds will be recovered, and on what timeline, remains unresolved.