$600 Million Drained As Poly Network Is Attacked In Largest DeFi Hack On Record

Poly Network, a multi-chain platform that provides interoperability between blockchains, reportedly suffered an attack on Binance Smart Chain, Ethereum and Polygon, losing over US$600 million, making it the biggest DeFi heist in history.

The protocol urged all miners of the affected blockchain and crypto exchanges to blacklist tokens coming from a list of addresses from the hacker (or hackers). However, one user told the attacker(s) to try depositing the stolen funds without Tether – which they did, placing all the addresses into Curve.

As a show of gratitude for the help, the hackers gifted the user US$45,000 in Ethereum.

Hacker Returns $258M

At about 4:00 am UTC, the hacker sent an ETH transaction to himself with a private note saying “ready to return the fund”. In a subsequent message, he asked for a multisig wallet to transfer the funds to after failing to contact Poly.

The protocol provided the hacker with three different addresses from BSC, ETH and Polygon to return the funds. “We are preparing a multisig address controlled by known Poly addresses,” Poly Network said in a private message embedded in an ETH transaction to the address provided by the hacker(s).

Media Outlets Scramble to Cover Biggest Ever Heist

This is the most controversial theft in the history of DeFi, so much that media outlets like Bloomberg, the Wall Street Journal, CNBC and Reuters have covered it too. Other heists amounted to relatively small sums, such as the US$25 million stolen from Popsicle Finance or the $13 million stolen from THORChain.

After the hacker(s) showed intentions to return the funds, software developer O3 Labs suggested the person(s) behind the hack might be a white hat hacker – an ethical hacker that specialises in penetration testing and other testing methodologies to ensure the security of an organisation’s information system.