79thVault has recovered 15,000 BNB from the hacker who looted its 79AU liquidity pool on October 7, with the attacker returning roughly 92% of the 16,249 BNB stolen in the exploit. Stolen cryptocurrency is almost never recovered, making the partial return a rare win for the project. Even so, about 1,9 BNB — roughly 8% of the stolen total — remained outstanding as of the team's confirmation.

The 79thVault team confirmed the refund on X, linking an on-chain transaction for the recovered coins (transaction confirmation, official statement). The project said it plans to put the BNB back into its liquidity pool and permanently burn the LP tokens that result from the restoration. LP tokens are receipts representing a claim on a pool's assets, and burning them removes that claim, effectively locking the restored liquidity in place.

How much did the 79thVault hacker return?

The attack began on October 7, when an operator wallet pulled 2.01 million 79AU tokens out of the project's pool on PancakeSwap, a decentralized exchange where trades execute against liquidity pools funded by user deposits. The perpetrator executed seven transactions between 07:25 and 08:25 UTC to fully extract the funds, then sold them for BNB through roughly 95 trades.

The selloff drained the pool's USDT reserves — Tether's dollar-pegged stablecoin — from about $15.2 million to $3.9 million. The sale of the 2.01 million tokens generated approximately 16,249 BNB, worth around $12.5 million.

79thVault blamed the incident on "weaknesses in account permission management" in its October 8 statement. However, reports state that the 79AU contract held an OPERATOR_ROLE function capable of moving tokens from the pool and rewriting its reserves, and that the permission was later revoked.

How much can Bitget recover from its hack?

Two incidents similar to the 79thVault refund have occurred within two weeks, showing that when an attacker can be identified and pressured, stolen funds can be recovered. That identification rests on the public nature of blockchain ledgers: stolen tokens leave a permanent, traceable trail every time they move between wallets.

Cryptopolitan reported that the NEAR Intents attacker sent back the entire $3.8 million stolen, roughly a day after general manager Alex Shevchenko posted the attacker's wallet addresses and issued a 48-hour ultimatum. "We have identified you, sir," Shevchenko wrote.

Recovering money from heists tied to state-linked actors is far more complicated. Bitget CEO Gracy Chen said she is "not very optimistic" about recovering the $388 million stolen from her exchange last month, and said North Korea may be behind the breach. She pointed to the February 2025 Bybit hack, where only about 3.5% of roughly $1.5 billion was ever frozen.

Cryptopolitan also reported that Drift Protocol's $285 million exploit was linked to North Korean actors. More than six months later, a majority of the funds remain lost, and much of the haul was laundered through Tornado Cash, a crypto mixing service that pools and redistributes deposits to obscure the origin of funds.