1. A former regulator endorses the White House approach
Chris Giancarlo, a former chairman of the Commodity Futures Trading Commission (CFTC), said on October 26 that the White House's August program for striking back at cybercriminals has "probably got it just about right." Giancarlo had proposed in 2025 that private hackers be hired to pursue crypto thieves, and he described the administration's narrower, government-controlled design as a mature and thoughtful document.
The endorsement carries weight because Giancarlo is the person most associated with the idea that the program now improves upon. In an interview recorded October 26, he said that after reading the memo he nearly wondered whether his own earlier idea should embarrass him, since it contained none of the restrictions the White House has written in. His praise was measured rather than sweeping, and he acknowledged that some critics believe the plan does not go far enough.
2. What is the White House hack-back plan?
The plan is a memo dated August 12, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," which sets up a government-run program in which vetted private contractors work for the Department of Justice (DOJ) or the Department of Homeland Security (DHS) against foreign criminal groups. Contractors are not free agents: each operation needs written approval from the program's executive directors at both agencies.
Hack-back is the informal name for letting victims, or those acting for them, go on the offensive against attackers instead of only defending their own systems. The practice has long been controversial because attribution online is difficult, because systems used by criminals are often owned by innocent parties, and because intrusions into another party's computers can themselves be illegal. The August memo is an attempt to capture some of the benefit of offensive action while keeping decisions in official hands.
Participants may also be required to post a bond or escrow of at least $1 million. A financial stake of that size gives the government a way to hold contractors accountable if an operation goes wrong, and it screens out firms that cannot absorb the consequences of a mistake.
3. How does it differ from the letters of marque idea?
The older proposal drew on letters of marque, the historical instrument by which governments authorized private ships to capture vessels belonging to an enemy. In a February 2025 opinion piece written with Chris Perkins, co-host of the Bits + Bips podcast, Giancarlo suggested a modern version. It would allow American companies to recover funds held by governments, entities or individuals under sanctions from the Treasury's Office of Foreign Assets Control (OFAC), with protection from U.S. prosecution for doing so.
The piece appeared after the Lazarus Group's $1.4 billion theft from the Bybit exchange, one of the largest crypto heists on record. Giancarlo took the concept to the White House Crypto Summit the following month, putting a hack-back idea in front of officials who were then shaping the administration's approach to digital assets.
The August memo departs from that vision on several points. It limits targets to foreign criminal groups that are not an institutional part of a foreign government and are not wholly directed by one. A group is treated as non-state unless clear intelligence shows otherwise. And it grants no immunity: participants must comply with laws such as the Computer Fraud and Abuse Act, the main U.S. statute against unauthorized computer access.
4. What are letters of marque, and why were they proposed?
A letter of marque is an old legal instrument. Centuries ago, governments issued such documents to private ship owners, authorizing them to seize vessels of an adversary and keep a share of the proceeds. The United States Constitution still lists the power to grant letters of marque among the authorities of Congress, although the practice has been dormant for generations. Giancarlo's idea was to borrow the logic for cyberspace: if private actors can find and recover stolen assets faster than governments can, they should be given legal cover to try.
The appeal for the crypto industry is easy to see. Digital assets can be moved across borders in minutes, and the people who steal them often sit beyond the reach of ordinary law enforcement. Traditional tools such as subpoenas, extradition and mutual legal assistance treaties move slowly compared with an attacker who can split and relocate funds between wallets within hours. Supporters of private action argued that the speed gap favors thieves, and that skilled firms with the right authority could narrow it.
The concern on the other side is equally old. Privateering historically produced disputes over who was a legitimate target, and nations at times protested the conduct of those holding a commission. In a networked world, where attackers disguise their location and route activity through machines belonging to unrelated people, the risk of striking the wrong target is considerable. The August memo's answer is to keep the authority with the government and to apply it only to groups that are plainly criminal rather than state-directed.
5. Why did Giancarlo change his view on who decides?
Asked whether privateering could escalate a conflict, Giancarlo said that risk is the reason he regards the memo as prudent. The central flaw in his own approach, he said, was trusting private companies to make judgments about statecraft. Such choices have traditionally belonged to elected officials, and he noted that they can mean life or death for citizens.
That is a notable shift for a proposal's author. A private firm pursuing a thief across borders could, in principle, run into infrastructure tied to a state, and a company acting on its own commercial judgment might not weigh the diplomatic consequences. Under the memo, the escalation question is moved out of corporate boardrooms and into the agencies that answer to the executive branch.
Ari Redbord, global head of policy at the blockchain analytics firm TRM Labs and a former federal prosecutor, made the same point on the program. He said that under the memo, decisions about escalation rest with the Department of Justice and the government, not with private firms.
6. Why does vetting and accountability matter?
Two features of the program stand out as responses to the weaknesses of the earlier proposal. The first is vetting. Because participants are contractors working for DOJ or DHS, the government chooses who may take part, rather than leaving the field open to any company willing to try. That allows officials to consider a firm's track record, its technical capability and its record of respecting legal limits before it is permitted near an operation.
The second is the absence of immunity. Under the earlier concept, companies would have been shielded from U.S. prosecution. The memo does the opposite: it requires compliance with existing statutes, including the Computer Fraud and Abuse Act. In practice, this means a contractor cannot treat the program as a blanket license, and each action must fit within the written approval granted for that operation.
Taken together with the bond or escrow of at least $1 million and the dual sign-off from the executive directors at the Department of Justice and the Department of Homeland Security, the design creates several checkpoints between an idea for an operation and its execution. For a policy area where a single mistake could harm an innocent party or strain relations with another country, those checkpoints are the main reason Giancarlo regards the plan as sound.
7. Is a narrow program enough?
Giancarlo accepted that critics think the plan falls short. His answer was to favor starting small and building from there. He described the current design as probably right "for the time being," and said the next step is simply to watch how the program develops.
That incremental stance reflects the trade-off at the heart of the debate. A broad authority could recover more stolen funds and deter more attacks, but it carries greater risk of mistakes, legal exposure and diplomatic fallout. A narrow authority limited to non-state criminal groups is safer, though it leaves outside its scope the state-backed actors, such as the Lazarus Group, that were behind some of the largest crypto thefts.
8. What happens next for the program?
The memo set a deadline of October 11 for operating procedures. As of October 27, no public release of those procedures had been found, so the practical details of how contractors will be vetted, supervised and paid have not been made available to outside observers.
Those procedures will largely determine whether the program is meaningful. The bond requirement, the approval process at DOJ and DHS, and the treatment of groups whose links to a government are unclear are all questions the memo leaves for implementation. Until the rules are published, endorsements such as Giancarlo's rest on the memo's stated principles rather than on seeing the program operate.
For the crypto industry, which has absorbed repeated large thefts, the outcome matters. Exchanges, protocols and their users have few remedies once stolen funds are moved offshore and laundered. A program that is lawful, supervised and limited to criminal groups would add a new option, while an overly cautious one might see little use. Giancarlo's view is that the cautious start is the right one, and that the proof will come from how it develops.
Readers following the story should watch for the publication of the operating procedures and for any word on which contractors are admitted. Those details will show whether the program can deliver on the promise Giancarlo sees in it, and whether the balance he calls about right holds up once real operations begin.