The United States is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the HAFNIUM cyberattacks, according to multiple reports. The reward is tied to a U.S. criminal case involving Zhang Yu and another individual, Xu Zewei.
Sources say Xu Zewei is already extradited to the United States, after being returned from Italy in April 2026, while Zhang Yu remains sought. The HAFNIUM campaign refers to the 2021 Microsoft Exchange Server intrusions attributed to hackers who exploited vulnerabilities, breached thousands of computers, and accessed data. One outlet notes U.S. officials describe Zhang Yu as a prominent figure in the campaign and states the reward aims to produce actionable information that helps locate him.
While the outlets differ slightly in emphasis—some foreground the State Department reward notice and others the alleged scale of the compromises—they converge on the same core facts: the accused’s name, the amount of the reward, and the linkage to the 2021 Exchange-based HAFNIUM attacks.
