Hackers stole more than $600 million in an attack on cross-chain protocol Poly Network

An unusual issue on the protocol led to the hack; no single keeper was responsible for the attack.

Poly Network victim of largest DeFi hack, tokens on Ethereum, Binance Smart Chain and USD Coin network stolen 

Poly Network announced that the cross-chain protocol was hacked for more than $600 million worth of cryptocurrencies. The victim of the attack is a protocol that was formed by an alliance between teams behind Neo, Ontology, and Switcheo. Poly network protocol is used for swapping tokens across blockchains like Bitcoin, Ethereum, and Ontology. 

The attackers stole $273 million in Ethereum tokens, tokens worth $253 million on Binance Smart Chain, and $85 million in tokens on USD Coin.

Poly Network team has urged exchanges and miners to block stolen funds. The cross-chain protocol called on Binance, Coinbase Pro, Huobi Global, OKEx, Tether and Circle to take immediate actions. 

The hacker attempted to launder the stolen funds by depositing them on Curve.fi, an exchange liquidity pool. The first few attempts were rejected by the mining pool. However, subsequent attempts were successful. Colin Wu, a Chinese journalist, revealed further details of the attacker's deposits on Curve finance in his tweet:

The initial deposit attempts by the hacker failed since the Tether team had blacklisted the USDT tokens involved in the transfer. 

Interestingly, the tokens that the hacker attempted to deposit on Curve.fi came from a Binance smart chain address (beginning with 0x0D6e286). This implies that the stolen funds were not blocked on BSC.

Changpeng Zhao (CZ), CEO of Binance, stated in his recent tweet that no one controls BSC (or Ethereum), and the exchange has requested security partners to help Poly Network proactively. 

In a letter addressed to the hacker, the team states that they want to establish communication with the hacker and suggest that the assets be returned since law enforcement will regard the offense as a major economic crime. 

The Poly Network has completed its preliminary investigation of the hack and located the cause of the vulnerability. 

The exploit was not caused by a single keeper (utility actors that maintain the blockchain network), instead, the hacker exploited a vulnerability between contract calls. Cross-chain smart contract calls distribute computing, storage, network resources and ecology among blockchains. 

The implications of the attack extend beyond the Poly Network. O3, a trading pool that uses Poly Network for cross-chain swapping, has suspended the functionality. 

Blockchain security firm tracks down the attacker's device fingerprint, IP info and email address

SlowMist, a blockchain security firm, stated that they have tracked down the attacker's ID and tracked them. According to SlowMist, the hacker exchanged original funds in Monero for Binance coin, Ethereum, Matic and other tokens and used these cryptocurrencies to fund the attack on Poly Network. 

Blue, CTO at SlowMist, said, 

We told [Poly Network/O3] that we have some information about the hacker; if they need, we will share it to them.

The hacker may likely respond to Poly Network's attempt at recovering the stolen funds since a transaction from one of the attacker's wallets included a message:

IT WOULD HAVE BEEN A BILLION HACK IF I HAD MOVED REMAINING SHITCOINS! DID I JUST SAVE THE PROJECT? NOT SO INTERESTED IN MONEY, NOW CONSIDERING RETURNING SOME TOKENS OR JUST LEAVING THEM HERE.

The hack that Poly Network suffered is the largest DeFi hack since it accounts for over 58.2% of the market cap of all decentralized finance tokens. 

Lucas Nuzzi, Network data product manager at Coin Metrics, slammed the Poly Network team and explained that "The Poly hack" seems to be enabled by how Poly-Bridge validates cross-chain transactions, not smart contract languages.