U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
- ID
- 33122
- Status
- summarized
- Published
- 08 Oct 2026, 3:42 PM
- Fetched
- 08 Oct 2026, 5:56 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 2.5
- Created
- 08 Oct 2026, 5:57 PM
- Tags
- Audience
- developers
What happened
The U.S. State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a Chinese national charged in Houston federal court over the 2021 HAFNIUM attacks on Microsoft Exchange Server. The nine-count indictment dates from November 2023 and was unsealed in July 2025; the alleged intrusions ran February 2020 to June 2021, and co-defendant Xu Zewei was arrested in Milan in July 2025 and extradited to the U.S. in April 2026. Zhang, described in the indictment as a director at Shanghai Firetech Information Science and Technology who worked on tasks assigned by the Shanghai State Security Bureau, remains at large and the charges are untested in court. The $10 million figure and wording match an offer the program was already making in January 2025.
Why it matters
This is an enforcement and bounty update, not a new vulnerability, tool, or patch — the text contains no new indicators of compromise, no CVE, and no affected-version detail, so there is nothing here to change in a build, deploy, or dependency pipeline this week. The only concrete hook is historical: the HAFNIUM campaign abused Microsoft Exchange Server between February 2020 and June 2021, so if you still run on-prem or hybrid Exchange, treat this as a reminder to verify you are actually patched for that era of Exchange flaws rather than as a reason to act on this article. For everyone else — app developers, AI/agent builders, SaaS founders on cloud-managed mail — the practical decision is to file it under policy news and not spend a sprint on it.
Discussion angle
The reward amount and wording are unchanged from a January 2025 offer, and the indictment is from November 2023 — so what actually moved here? Worth debating whether naming-and-bountying contractors like Zhang and the extradition of Xu from Italy is a meaningful deterrent for state-directed hacking, or whether it mostly signals attribution work that builders never see the technical output of.