The U.S. State Department is offering up to $10 million for information on Zhang Yu, a Chinese national charged over the Hafnium hacking campaign, The Record reported Wednesday. Zhang, a director of Shanghai Firetech Information Science and Technology, remains at large, while his co-defendant is already in U.S. custody.

What Happened

The reward is being offered through Rewards for Justice, the State Department program that pays for tips on people wanted for national security crimes. Prosecutors accuse Zhang and Xu Zewei of a string of computer intrusions between February 2020 and June 2021, including the Hafnium campaign. A nine-count indictment charges the pair with offenses that include violations of the Computer Fraud and Abuse Act.

According to prosecutors, the two men stole COVID-19 research from U.S. universities, immunologists and virologists during the early months of the pandemic. The targets named in the case include at least one university and a law firm. Prosecutors say Zhang and Xu acted on orders from China's Ministry of State Security and the Shanghai State Security Bureau and reported their results back to those agencies.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

Xu was arrested by Italian authorities in Milan in July 2025 while on vacation and was extradited to the United States in April.

Brett Leatherman, an assistant director in the FBI's Cyber Division, put the scale of the campaign in numbers. He said Hafnium targeted more than 60,000 U.S. entities and successfully victimized more than 12,700 of them.

Why It Matters

Hafnium is the name Microsoft gave in 2021 to the China-based group it blamed for the mass exploitation of on-premises Microsoft Exchange Server that year, one of the most widespread hacking incidents of the pandemic period. Microsoft now tracks the group as Silk Typhoon. The charges against Zhang and Xu tie at least part of that activity to a private Shanghai company working for China's state security services.

That link is central to the U.S. case. Zhang is identified as a director of a Shanghai technology company, and prosecutors say he and Xu took their orders from the Ministry of State Security and the Shanghai State Security Bureau. Over the past several years, the United States has increasingly used indictments, sanctions and rewards against people and companies that carry out hacking for China's security services, not only against the agencies directing them.

The Limits of a Reward

The Record described Zhang as still at large. Charges alone rarely lead to an arrest when a suspect stays out of reach of U.S. law enforcement, and China does not extradite its nationals to the United States. A public reward raises the stakes of travel, since anyone who spots him in a country willing to cooperate could collect up to $10 million. Xu's case shows how that can play out: he was detained in Italy during a vacation, years after the alleged intrusions.

What to Watch

The next developments are likely to come from Xu's prosecution, where court filings could add detail about how Shanghai Firetech operated and how tasking passed from China's security services to the company. Any tips generated by the reward, or further charges against others at the firm, would extend the case beyond the two men named so far.