US Puts $10 Million Bounty on Chinese Man Charged Over 2021 Microsoft Exchange Attacks

The US State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The offer comes through the Rewards for Justice program and was reported by the news outlet NTD. Zhang remains at large, and the charges against him have not been tested in court.

Zhang and a second man, Xu Zewei, are charged together in federal court in Houston. The nine-count indictment dates from November 2023 and was made public in July 2025. It alleges the hacking took place between February 2020 and June 2021. Xu was arrested in Milan in July 2025 and extradited to the United States in April 2026. US authorities describe Zhang as a director at Shanghai Firetech Information Science and Technology. According to the indictment, he worked on tasks assigned by the Shanghai State Security Bureau, a branch of China's Ministry of State Security, and supervised hacking by other Firetech staff.

The FBI's Brett Leatherman said Xu is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and that others face the same risk. The reward wording and amount match an offer the program was already making in January 2025.