Poly Network: The $611M Hack With a Plot Twist

Stole $611 million. Then gave it all back.

Poly Network cross-chain bridge

This is the strangest hack in crypto history. Someone stole $611 million from the Poly Network cross-chain bridge and then, over the following two weeks, gave essentially every penny back.

Poly Network's design let assets move between Ethereum, Binance Smart Chain, and Polygon through a system of smart contracts that relied on a designated "keeper" address to authorize any cross-chain transfer. The attacker found a flaw in how the EthCrossChainManager contract verified those keeper permissions and used it to trick the system into changing the authorized keeper to an address they controlled. Once they held that authority, they could approve withdrawals to themselves from all three chains without needing to break any cryptography at all. Total haul: $611 million, instantly the largest DeFi hack ever recorded at the time.

Poly Network's team, in a genuinely unprecedented move, posted an open letter directly on Twitter addressed to the hacker, calling them "Mr. White Hat" and pleading that the stolen money belonged to tens of thousands of ordinary users, not the protocol itself. Blockchain security firm SlowMist said within hours that it had traced an email address, an IP address, and device fingerprints tied to the attacker, a detail that likely factored into what happened next.

The hacker started talking. Using a Q&A format embedded directly in on-chain Ethereum transaction data, small amounts of ETH sent with messages attached that the hacker would answer the same way, they explained the theft was done "for fun" and to expose the vulnerability before someone with worse intentions found it first. One widely circulated message read: "I am not very interested in money! I know it hurts when people are attacked, but shouldn't they learn something from those hacks?" Over the following days, the funds started moving back in batches across all three chains.

The return wasn't entirely clean. A portion of the stolen USDT had already been frozen by Tether once it recognized the funds as stolen, complicating the handoff, and some of what the hacker tried to send back ended up locked in a multi-signature arrangement that needed sign-off from both Poly Network and the hacker to release, creating an odd standoff over money that had technically already been "returned." By August 23, 2021, essentially the full $611 million had made its way back to Poly Network's control.

Poly Network responded by publicly offering the hacker a $500,000 bug bounty and, in a move that baffled the entire industry, a position as the protocol's Chief Security Advisor. It was never confirmed that the hacker formally accepted either offer or provided a wallet to receive the bounty.

The crypto community couldn't settle on a single explanation. Genuine white hat ethics, an elaborate PR stunt engineered by the protocol itself, or a thief who simply realized that laundering $611 million in fully traceable, publicly watched crypto was never going to work, all got argued at length. The last theory is probably closest to the truth: with SlowMist already circling and every major exchange watching the tainted funds, a graceful, headline-grabbing return was the closest thing to a clean exit still available.

The Poly Network hack didn't just make headlines for its size. It became the reference case for an entire category of DeFi incident that followed: bridge and cross-chain infrastructure hacks, which went on to produce some of the largest thefts in crypto history, including Ronin's $625 million and Wormhole's $320 million, both exploiting the same underlying weakness of trusting a permission system across chains that don't naturally trust each other.