NUΞ

People are saying all kinds of terrible things while being uninformed so allow me to share more details. I've initiated coordination privately with Immunefi officials 3 hours before the white-hack. 90 minutes later, I realized the asset is currently used by the frontend and although the contract is not in scope (which almost certainly means a zero-ish bounty), fully disclosed it to Sushi with a mainnet fork POC. About 30 minutes later Sushi replied saying they are actively working on it. Unfortunately, Immunefi system only sent a mail saying the issue is escalated (automated msg), and not that there's a new message, due to throttling. The script locating wallets at risk finished and showed 0xsifu has the vast majority of funds at risk. It was ~5:30 AM local time and I saw an option to save most funds. There was incomplete information - I couldn't know if the team would reply before the start of next week. You can't know when an attacker would strike and steal all funds. MEV was a possibility, but didn't imagine it would be this fast and deadly (attack required a callback and had 2 setup transactions). I had a ledger setup so going private mempool would take a long time. I decided to white-hack 100 ETH (to verify I'm not bricking most funds) followed by the rest of 0xsifu and other significant wallets. 99.99% of people have never put themselves in such high-pressure situations and don't know what it's like. I've also factored in that the contract can't be paused and you can't coordinate everyone's revokes, so white-hack is the only real play even for the team. In hindsight, it was a mistake. But we're all biased with the results in a specific universe where the MEV unknown was worst-case, the team was actually aware, and we don't get a chance to see an attacker taking it all without the white-hack. Everyone who knows me is aware of the countless millions of $ I've saved in the ecosystem, my ethics, integrity, transparency, and never-ending support and education for new auditors. Seeing some allegations and people bashing me without context is heartbreaking. The only thing keeping me from sinking is support from dear community members and friends. Let's take the opportunity to improve as a community and formulate clear policies for when white-hacking is the right thing to do (it's usually not) and the exact procedure. Regarding the 10ETH bounty 0xsifu chose to award me, which seemed to annoy some folks, I'm donating it to the recovery fund. If my intention was to monetize from this hack there were a billion better ways. I'm here for the crypto users and will continue to ethically safeguard them for years to come.