The crypto whale who lost $71 million worth of wrapped bitcoins (WBTC) via a dusting attack has recovered the stolen funds after negotiations with the hacker.

According to a tweet by blockchain security firm PeckShield, the scammer began returning the funds on May 9 and completed the process on May 11.

Stealing $71M WBTC

The whale’s woes began on May 3 after they mistakenly sent 1,155 WBTC to a wrong address placed in the transaction history via address poisoning.

An address poisoning or dusting attack is a scam in which a malicious actor sends a transaction of zero or negligible value to a victim’s wallet to make the address appear in their transaction history. These malicious addresses usually have similar starting and ending characters to those of the victim’s true wallets, making them undetectable on the surface.

As CryptoPotato reported, the malicious and real addresses had characters starting with 0xd9A1 and ending with 853a91 in this situation. Hence, the victim was tricked when he wanted to transfer his WBTC to a different wallet.

The scammer did not move the stolen assets until five days later, when they started to break down the stash into smaller portions. They used over 400 wallets to distribute the funds to around 150 addresses. Notably, they had swapped the loot to approximately 23,000 ether (ETH) on May 3.

The Recovery

Details of the negotiations between the scammer and victim are not available as it appears the discussion took place on Telegram.

The victim first reached out to the scammer on May 5, offering a 10% in return for the stolen funds. In cooperation with blockchain cybersecurity firm Match Systems and crypto exchange Cryptex, the victim threatened to trace the funds if the attacker failed to respond by May 6.

After a few days of silence, the scammer sent some ETH to the victim alongside a message requesting their Telegram handle for proper discussions. Following the talks, the attacker returned the loot in batches. It remains unknown why the malicious actor returned the assets in total, discarding the 10% bounty offer.

Meanwhile, the worth of the returned assets hovers around $66.8 million because ether has declined more than BTC in the past week. Data from CoinMarketCap shows ETH fell over 6.4% while BTC slumped roughly 2.8% within the same time frame.