Hafnium hacker Zhang Yu: US offers $10 million reward

The US State Department has put a $10 million bounty on Zhang Yu, a Chinese national whom American officials describe as a central figure in the Hafnium hacking campaign. The reward is for information on his whereabouts.

According to US officials, Zhang is the director of Shanghai Firetech Information Science and Technology and acted on behalf of the Chinese government. The campaign he is accused of supporting compromised thousands of computers and led to the theft of large volumes of documents and emails.

COVID-19 research in the crosshairs

Officials allege that Zhang worked with Xu Zewei, another Chinese national charged in the case. The pair are accused of stealing COVID-19 research from US universities, immunologists and virologists.

The State Department said Zhang's cyberattacks broke the Computer Fraud and Abuse Act (CFAA), the main US federal anti-hacking law. Among the targets were at least one university and a law firm.

The two men took very different paths after they were charged. Zhang is still at large. Xu was arrested by Italian authorities in July 2025 while on vacation in Milan, and he was extradited to the United States in April.

A nine-count indictment

The US Justice Department made a nine-count indictment against both men public last year. It accuses them of taking part in "computer intrusions between February 2020 and June 2021, including the indiscriminate HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States."

Prosecutors say the hacking was ordered by two Chinese intelligence bodies: the Ministry of State Security (MSS), China's main civilian intelligence and security agency, and its regional branch, the Shanghai State Security Bureau (SSSB).

The defendants allegedly reported to supervising officers at the SSSB. In one case, according to prosecutors, Xu confirmed that he "had compromised the network of a research university located in the Southern District of Texas." The Southern District of Texas is a federal judicial district that includes Houston.

The scale of Hafnium

US officials have said the campaign was very large. Speaking last year, Brett Leatherman, assistant director of the FBI's cyber division, gave figures for its reach.

"Through HAFNIUM, the CCP targeted over 60,000 U.S. entities, successfully victimizing more than 12,700 in order to steal sensitive information," Leatherman said.

The CCP is the Chinese Communist Party. US officials often use the term when they attribute state-backed operations to Beijing.

Why the reward matters

A $10 million reward is one of the State Department's largest standard offers. It signals that Washington sees Zhang as a high-value target, even though there is no realistic way to arrest him while he stays in China.

The reward also says something about how the US goes after state-backed hackers. Indictments against Chinese intelligence operatives rarely lead to trials, because the suspects seldom leave countries that will not hand them over. Xu's case shows the exception. He was picked up while traveling in Italy and ended up in an American courtroom. Similar travel-related arrests have happened elsewhere, as in the case of an Iranian hacker extradited from Montenegro and a Qilin ransomware suspect detained in Japan and sent on to Germany.

Our Take

This reward fits a familiar pattern. When the US cannot reach a suspect directly, it uses public indictments, named companies and large bounties to make life harder for people it accuses of working for foreign intelligence services. The aim seems to be pressure more than a near-term arrest. Every trip abroad becomes a risk, and anyone close to the suspect is given a reason to come forward.

Two details stand out. First, Zhang is linked to a named private company, Shanghai Firetech. This suggests that US authorities continue to focus on the contractor ecosystem that allegedly carries out work for Chinese intelligence, not only on government officers. Second, the targets named in the case, universities, researchers and a law firm, are a reminder that academic and professional services networks remain attractive to state-backed groups. That is especially true when they hold research of strategic value. Readers in those sectors should not assume they sit outside the threat model of China-linked espionage operations.

It is worth watching how Xu's prosecution develops now that he is in US custody. Court filings in his case could reveal more about how the Hafnium operation was tasked and run. It also remains to be seen whether the reward produces any useful leads on Zhang, or whether it mainly serves as a public statement of attribution.