Whitehat
A white hat, or ethical hacker, is a security specialist who, with the explicit authorization of the system owner, uses offensive hacking techniques to identify and privately report vulnerabilities in cryptocurrency and digital-asset systems such as blockchains and smart contracts.[9][10][3] They aim to prevent permanent on-chain loss by testing crypto protocols, exchanges, wallets and bridges through audits, penetration tests and bug bounty programs defined by project teams under written rules.[9][10][8][3] Controversial rescue operations—such as the 2025 Coldcard wallet exploit response and the 2026 Liquid Network incident, in which self-described white hats moved and later returned user funds—sit in legal and ethical gray areas when prior authorization is unclear.[11][12]
Etymology and Terminology
The color imagery derives from a convention in old Western films, in which heroic characters traditionally wore white hats and villains wore black hats.[1][5] By the mid-1960s "white hat" was being used more generally in American English to mean a person perceived as one of the "good guys" or as being on the side of right, a broad sense the Cambridge Dictionary still records as "someone in a particular situation who is acting for morally good reasons."[4][6] By the early 1990s the convention had carried into computing to distinguish benign from criminal hackers, and this language was later adopted by cryptocurrency exchanges, wallet manufacturers, and protocol teams to distinguish authorized security researchers ("white hats") from exploiters ("black hats") in blockchain, DeFi, and wallet security contexts.[2]
The hat vocabulary belongs to a longer disputed history around the word "hacker" itself. Students at the Massachusetts Institute of Technology coined "hacking" in the 1950s to describe a creative style of computer use, but journalists in later decades began applying "hacker" to computer intruders, prompting some technologists to adopt "cracker" to distinguish malicious actors—a distinction preserved in the Jargon File and in Eric Raymond's 2003 Jargon File entry "Cracker."[7] A three-way scheme emerged from within the underground: in the report Wearing Many Hats, researchers Matt Goerzen and Gabriella Coleman describe black hats as those who disregard the law, white hats as those who try to work inside it, and grey hats as occupying an in-between position, maintaining underground credibility while signing contracts and working publicly.[7] In the crypto and Web3 ecosystem this same scheme is applied to actors probing smart contracts, DeFi protocols, exchanges, and wallet software: white hats participate in authorized audits and bug bounties, black hats exploit vulnerabilities for personal gain, and grey hats disclose or exploit flaws on-chain without clear permission while sometimes negotiating returns. The authors caution that the white/black imagery masks ongoing negotiation over what counts as ethical conduct in computer security, and note contemporary debate—including references to scholarship such as Patricia Hswe and colleagues' "Toward Anti-Racist Technical Terminology" and social-media commentary around 2020—about the racial connotations of the "black hat" label, debates that have also surfaced in discussions of Web3 security terminology.[7]
How Ethical Hacking Works
The modern white-hat engagement rests on a contract that separates it from crime. What makes an action white hat is a four-part arrangement: the owner gave written permission, the work stays inside an agreed scope, findings are reported privately to the owner rather than sold or leaked, and nothing is damaged or stolen—removing any element can turn the same technical actions into a crime.[2] In the crypto and Web3 space, authorization typically takes the form of a signed audit contract with a protocol team, an exchange, or a wallet manufacturer, a statement of work for reviewing specific smart contracts or bridge components, or the published rules of a bug bounty program that covers particular contracts, domains, or API endpoints.[3] These terms define which on-chain contracts, off-chain services, keys, or infrastructure may be touched, how tests must avoid real-user losses, and what happens if a vulnerability could endanger live funds; they also specify data-handling requirements for logs, private keys, or user information obtained during testing.[8][2]
An engagement against a crypto target generally follows phases that mirror attacker behavior while staying inside authorization. During reconnaissance, the tester maps the in-scope attack surface using blockchain explorers, public smart contract source code, project documentation, GitHub repositories, and on-chain analytics, then probes testnets or staging environments where possible. Scanning includes reviewing contract ABIs and interfaces, dependency graphs, and protocol architecture to identify known vulnerability patterns, such as re-entrancy risks, unchecked external calls, unsafe upgradeability, or insecure price-oracle integrations. The gaining-access phase involves constructing concrete exploits—for example, a sequence of DeFi transactions that drains a liquidity pool, manipulates an oracle, or bypasses a bridge validation check—often executed on a forked mainnet or testnet rather than against real user funds. Maintaining access may include demonstrating long-lived control over admin roles, upgrade keys, or validator sets, or showing how a stolen mnemonic could compromise wallet hierarchies, while carefully limiting any on-chain actions to avoid unintended side effects.[3] Finally, instead of clearing logs and cashing out, white hats document every step, provide reproducible scripts or transactions, and deliver them privately to the project along with remediation guidance.[2]
Ethical hacking in digital-asset systems is broader than traditional penetration testing.[1] Under the umbrella role sit several engagement types. Smart contract and DeFi audits are scoped, time-boxed assessments of protocol code and economic design that prioritize correctness and abuse resistance over a defined set of contracts. Red teaming for exchanges, custodians, or large protocols may emulate an adversary attempting to exfiltrate hot-wallet keys, abuse withdrawal queues, or compromise bridge validators, often over weeks to months and with limited prior notice to the internal security team.[3] Vulnerability assessments and automated scanning can provide wider but shallower sweeps of deployed contracts and infrastructure, flagging patterns associated with known exploit classes.[2] Bug bounty hunting lets independent researchers test in-scope contracts and services under public programs, paid per valid finding, with program rules governing actions such as testnet versus mainnet use, transaction value limits, or explicit prohibitions on interacting with production user funds.[2] Social-engineering tests for crypto companies often focus on phishing against employees with access to signing keys, build pipelines, or administrative dashboards rather than broad end-user campaigns.[1]
Because most blockchains are transparent and attacks execute directly against assets rather than only data, responsible behavior in crypto white-hat work usually means avoiding contact with real user funds unless expressly allowed. When white hats do move assets—for example, sweeping vulnerable wallets or draining an exploitable contract into a rescue address—they generally do so under pre-agreed conditions with the project team, or with an immediate public statement and on-chain proof of intent to return the funds, followed by a formal recovery process.[3] The resulting reports feed a defensive feedback loop: protocol upgrades, parameter changes, and incident-response runbooks are updated based on findings, and on-chain monitoring is tuned to detect the patterns of abuse that white hats have demonstrated in controlled form.[2][8]
Legal Status
Across jurisdictions the legal line is drawn at authorization, not intent. In the United States the Computer Fraud and Abuse Act criminalizes unauthorized access, so the same actions performed without permission are crimes; as CyberDefenders puts it, "There is no legal grey area: permission is the line."[3] In the United Kingdom, Struan Robertson, legal director at Pinsent Masons LLP and editor of OUT-LAW.com, explains that "if the access to a system is authorized, the hacking is ethical and legal. If it isn't, there's an offense under the Computer Misuse Act," which covers everything "from guessing the password to accessing someone's webmail account, to cracking the security of a bank," with a maximum penalty of two years in prison and a fine for unauthorized access and up to ten years where data is also modified.[4] Robertson adds that "unauthorized access even to expose vulnerabilities for the benefit of many is not legal. There's no defense in our hacking laws that your behavior is for the greater good."[1] The same principle governs grey-hat activity, which remains illegal because intent does not equal permission.[3]
These rules apply directly to digital-asset systems. Moving or "rescuing" funds on-chain without formal authorization from the protocol, exchange, or wallet provider can still violate computer-misuse and anti-hacking statutes even if the operator intends to return the assets, because the law generally focuses on access and interference rather than eventual outcome. Some white hats therefore constrain their crypto work to clearly scoped audits, testnets, and low-value experiments under written contracts or published bug bounty rules, and avoid interacting with production funds unless explicit safe-harbor language or emergency procedures are in place.[3] Various jurisdictions have begun clarifying safe-harbor or coordinated-disclosure frameworks for security researchers; however, these are often written with traditional IT systems in mind, and their application to Web3 contexts—where exploits and "rescues" are executed as public transactions on permissionless networks—can remain uncertain.
Belgium legalized white hat hacking in February 2023, subject to conditions,[1] and in July 2021 the Chinese government moved from voluntary reporting to a legal requirement that all white hat hackers first report any vulnerabilities to the government before addressing them further or disclosing them publicly, a change commentators described as creating a "dual purpose" in which white-hat activity also serves the country's intelligence agencies.[4] Such measures influence how crypto white hats in those jurisdictions approach disclosure to exchanges, wallet manufacturers, and protocol teams. Controversies around incidents like the 2026 Liquid Network exploit—in which purported white hats returned most of the BTC they had withdrawn only after negotiations with stakeholders—illustrate the gray area faced by self-described white hats who act first on public blockchains and seek to regularize their position later under existing law and platform-specific policies.[12] Governments have also become clients for authorized hacking: on October 20, 2016, the United States Department of Defense announced "Hack The Pentagon," inviting authorized researchers to probe its systems,[1] and some public tenders and programs now include or contemplate blockchain and smart contract components, further intertwining legal, institutional, and crypto-specific white-hat work.
Notable Crypto Whitehat Incidents (2015–2026)
Between 2015 and 2026, several high-profile incidents in the crypto ecosystem involved white-hat or quasi-white-hat actors intervening in live or imminent on-chain exploits. These examples are illustrative rather than exhaustive, and they show how security researchers have sometimes used the same technical vectors as attackers to attempt to safeguard user funds under urgent conditions.
The DAO and Parity Multisig Wallet Rescues (2016–2017)
In 2016, during the collapse of The DAO on Ethereum, ad hoc groups such as the Robin Hood Group coordinated a “hack back” that replicated the attacker’s re-entrancy exploit in The DAO’s flawed split function, which allowed repeated withdrawals before balances were updated.[13] By rapidly forking the relevant contracts, scripting transactions, and coordinating timing, they drained a large portion of remaining DAO funds—described as roughly $208 million worth of ether at the time—into white-hat-controlled child DAOs before the original attacker or copycats could take them.[13] The funds were ultimately returned via a community-led recovery that included an Ethereum hard fork and structured withdrawal processes, but the intervention remained controversial because it involved non-consensual movement of user assets and contributed to broader debates over chain immutability and the scope of “emergency” white-hat actions.[13]
In July 2017, the White Hat Group responded to a critical initialization bug in Parity multisig wallets that allowed an attacker to seize ownership and drain funds by re-invoking the wallet’s setup function.[14] After an attacker exploited the flaw against some wallets, the group used the same bug at scale, writing automated scripts to reinitialize vulnerable contracts, assign themselves control, and transfer funds into rescue wallets, ultimately securing hundreds of thousands of ETH that would otherwise have been exposed.[14] Those assets were later returned to owners through a coordinated claims process, while the incident raised ongoing questions about whether such large-scale, unilateral interventions—undertaken without explicit prior consent from each wallet owner—should be treated as ethical white-hat work or as unauthorized access justified after the fact.[14]
Lien Finance Vulnerability and 25,000 ETH Rescue (2020)
In 2020, security researcher samczsun identified a critical logic bug in a Lien Finance smart contract governing a tokenized bond sale that left approximately 25,000 ETH (around $10 million at the time) vulnerable to theft.[15] The flaw related to how the contract handled bidding and settlement in an auction, creating a state in which an attacker could purchase the entire ETH collateral for far below its intended price once the auction executed on-chain.[15] To prevent opportunistic bots or malicious actors from frontrunning any fix, samczsun coordinated privately with Lien, ConsenSys Diligence, PeckShield, and mining pool SparkPool to craft and submit a carefully ordered sequence of rescue transactions as a private bundle directly to the miner, ensuring they were mined atomically before the vulnerability became widely known.[15] The operation moved the at-risk ETH into safer contracts under Lien’s control, after which the protocol returned funds and patched its contracts; because the work was conducted with the team’s cooperation under a de facto emergency bug-bounty arrangement, it was generally framed as a conventional white-hat intervention rather than an unauthorized exploit.[15]
SushiSwap MISO Dutch Auction Bug (2021)
In 2021, researchers at Paradigm, including samczsun, discovered a severe vulnerability in SushiSwap’s MISO Dutch auction contracts that could have enabled the theft of roughly $350 million in tokens from projects conducting token sales on the platform.[16] The bug involved a flaw in how the MISO bidding contracts handled token distribution and initialization, combined with insufficient access control, which together could have allowed an attacker to inject a malicious address and reroute auction proceeds or withdraw unsold tokens.[16] Instead of exploiting the bug on-chain, the Paradigm team submitted a private, detailed report and proof-of-concept to SushiSwap, while bug bounty platform Immunefi helped coordinate communication and reward discussions.[16] SushiSwap paused affected contracts, deployed patched versions, and migrated active auctions, so no user funds were stolen; this incident is often cited as an example of white hats using deep protocol knowledge and simulated exploits, rather than live fund movements, to mitigate a large potential loss.[16]
Curve Finance Vyper Compiler Exploits (2023)
In July 2023, several Curve Finance pools were compromised after it emerged that specific versions of the Vyper smart contract compiler contained a faulty implementation of re-entrancy locks, leaving contracts that relied on those locks open to re-entrancy attacks.[17] Attackers and white-hat actors both targeted vulnerable pools such as those holding alETH, msETH, and pETH, using flash loans and carefully sequenced transactions either to drain funds for profit or to move liquidity into rescue addresses before it could be stolen.[17] According to post-incident analyses, white-hat coordinated actions secured millions of dollars’ worth of tokens by racing attackers on-chain and then routing recovered assets into governance-controlled recovery contracts, from which they were later distributed back to liquidity providers following community processes.[17] The episode triggered rapid patching of Vyper, contract upgrades, and new monitoring procedures, while also prompting discussion about the risks of “rescue racing,” where self-identified white hats and attackers use similar exploit techniques under time pressure, raising questions about authorization and coordination in emergency responses.[17]
Euler Finance Bug Bounty and Exploit Recovery (2023)
Euler Finance provides a contrast between conventional white-hat disclosure and a later large-scale exploit with a negotiated return. Before 2023, Euler had run a bug bounty program that received private vulnerability reports under standard terms, with researchers documenting issues and the team shipping fixes without any movement of user funds, matching typical expectations for authorized white-hat work.[18] In March 2023, however, an external attacker used a complex sequence of flash loans and protocol interactions to exploit a configuration issue in Euler’s lending markets, ultimately draining roughly $240 million in various assets from users.[18] Euler treated the incident as a criminal exploit and offered a public bounty for the attacker’s identification, but after weeks of negotiation, public statements, and apparent pressure from law enforcement and the community, the attacker returned essentially all recoverable funds on-chain to Euler-controlled addresses, which were then used to compensate users through a structured recovery plan.[18] The attacker framed the return as a form of “white-hat” resolution, while Euler’s account emphasized the absence of prior authorization and the legal uncertainty around retroactively rebranding an exploit as ethical research once negotiations succeed.[18]
Coldcard Hardware Wallet Exploit and Recovery Trust (2025)
In 2025, a vulnerability involving Coldcard hardware wallets led to compromised private keys for a subset of users, exposing on-chain funds controlled by those devices.[11] Self-described white-hat operators responded by deriving affected wallet addresses, monitoring them on-chain, and proactively sweeping at-risk bitcoin into a multi-signature “recovery trust” they had set up, rather than leaving the coins accessible to potential thieves or to the original, now-vulnerable keys.[11] Reporting described at least 52 BTC being moved into this trust, with the operators stating that the structure was designed to hold funds while affected users’ identities were verified and restitution plans agreed with Coldcard and other stakeholders.[11] The arrangement raised questions about control over the trust, the conditions for releasing funds, and whether sweeping coins without explicit consent from each wallet owner—albeit with the intent to return them—fit within accepted definitions of authorized white-hat activity or moved into a gray area of self-appointed custodianship.[11]
Liquid Network Sidechain Exploit by Purported White Hats (2026)
In 2026, actors who described themselves as white hats exploited a validation flaw in the Liquid Network Bitcoin sidechain, which is secured by a federation of functionaries that control peg-in and peg-out operations.[12] According to blockchain analysis, the exploit took advantage of an error in Liquid’s peg-out verification logic, allowing the attackers to craft transactions that bypassed intended controls and withdraw bitcoin reserves from Liquid’s custody addresses into their own wallets without following standard multi-signature and policy checks.[12] On-chain data indicated that over 1,000 BTC worth hundreds of millions of dollars at the time were removed, after which the operators engaged in public negotiations with Liquid stakeholders, ultimately returning approximately 85% of the withdrawn BTC while retaining a portion and describing the episode as a security demonstration.[12] The incident prompted Liquid to patch the validation flaw and review federation procedures, while regulators, users, and commentators debated whether the exploiters’ partial return and self-applied “white hat” label mitigated what appeared, in technical and legal terms, to be an unauthorized breach of a custodial system.[12]
Across these and similar incidents, the experience of on-chain “rescues” has driven the evolution of best practices, including formalized incident-response runbooks for DeFi, on-chain rescue playbooks, and clearer bug bounty and safe-harbor policies for crypto white hats.
