Harmony officials said that if the attacker returns the stolen funds and shares the vulnerability information, it will provide a bounty of $1 million.
Harmony argued that criminal charges against the attackers would not be brought when the funds were returned.