DeFi project teams typically propose a condition: if the hacker returns the vast majority of the funds, they may keep typically 10%–20% as a bug bounty and will not pursue legal liability.