US offers $10 million reward for accused Chinese Hafnium hacker Zhang Yu

The US State Department is offering a reward of up to $10 million for information on the whereabouts of Zhang Yu, a Chinese national accused of being a key figure in the Hafnium hacking campaign, according to The Record. US officials allege the campaign breached thousands of computers worldwide and stole documents and emails, and that Zhang acted on behalf of China's Ministry of State Security. The reward, announced on October 7, underlines Washington's continued effort to identify and pursue individuals behind state-backed cyberespionage, even when they remain beyond the reach of US courts.

What happened

The Record reported that the officials' statement links to the State Department's Rewards for Justice program. According to US officials, Zhang directs Shanghai Firetech Information Science and Technology and has worked for the Chinese government. He remains at large.

Officials also allege that Zhang violated the Computer Fraud and Abuse Act by targeting at least one university and a law firm.

The charges

According to The Record, a nine-count indictment unveiled in 2025 accuses Zhang and co-defendant Xu Zewei of computer intrusions between February 2020 and June 2021. Prosecutors cite what they called the "indiscriminate HAFNIUM computer intrusion campaign," which compromised thousands of computers around the world, including in the United States.

Prosecutors say the two men acted at the direction of the Ministry of State Security and the Shanghai State Security Bureau and reported to supervisors there. Xu allegedly confirmed to his handlers that he had compromised a research university in the Southern District of Texas. Zhang allegedly worked with Xu to steal COVID-19 research from US universities, immunologists and virologists.

The scale of the campaign was significant. The Record cites FBI Cyber Division assistant director Brett Leatherman, who said in 2025 that the operation targeted more than 60,000 US entities and victimized more than 12,700.

The co-defendant

Xu Zewei was arrested by Italian authorities in July 2025 while on vacation in Milan and was later extradited to the United States, The Record reported. The allegations against both men have not been proven in court.

Why it matters

Rewards of this size are typically used when suspects are believed to be living in countries that will not extradite them. While such offers rarely lead to quick arrests, they publicly name individuals and companies tied to state operations and can restrict their travel, as Xu's arrest during a trip abroad shows. For defenders, the case is a reminder that Hafnium-era intrusions exploited widely deployed internet-facing systems, and that patching exposed servers quickly and monitoring for web shells and unusual email access remain essential.