Poly Network: The $611M Hack With a Plot Twist

On 10 August 2021 someone emptied Poly Network across three blockchains at once and walked off with about $611 million in crypto. It was, at that moment, the largest theft in crypto history. Then the thief started sending it back, chatting with the victims in public as they went. Thirteen days later the last of it was returned.

Poly Network was a bridge, a service that moves money between blockchains that cannot talk to each other. Ethereum, Binance Smart Chain (now BNB Chain) and Polygon each keep their own separate ledger, like three banks with no shared payment system. A bridge holds coins on one chain and issues matching coins on another, a little like a currency exchange desk at an airport that takes dollars on one side of the counter and hands out euros on the other. Whoever can command the desk can empty both drawers. Poly Network had been set up in 2020 by the teams behind three blockchain projects, Neo, Ontology and Switcheo.

The haul broke down roughly as $273 million taken on Ethereum, $253 million on Binance Smart Chain and $85 million in USDC, a dollar-backed stablecoin (a digital dollar), on Polygon. Thousands of users' deposits sat in those pools.

How the desk was hijacked

Poly's bridge ran on smart contracts, programs on a blockchain that move money by themselves when their conditions are met. Payouts were authorised by "keepers": a short list of computer accounts, run by the Poly team, whose digital signatures the contracts trusted. The list of keepers was stored in one contract. A second contract, called EthCrossChainManager, carried out instructions arriving from other chains, and it was one of the few things allowed to edit that list.

The flaw was that the manager would pass on almost any instruction, to almost any function, if it was wrapped correctly. The attacker built a message from another chain that, once processed, told the keeper list to replace its contents with the attacker's own key. The security firm CertiK traced the root cause to how access rights were split between the two contracts. In office terms, the internal mail room would deliver any envelope to any department, including the one that keeps the list of who may sign the cheques. No password was cracked. With themselves listed as the keeper, the attacker simply signed withdrawals to their own addresses on all three chains.

The thief starts talking

Poly Network's team posted an open letter to the attacker on Twitter within hours, pointing out that the money belonged to tens of thousands of ordinary users and urging them to talk. Tether, the company that issues the USDT stablecoin, froze about $33 million of USDT in the attacker's wallet. The Chinese security firm SlowMist said it had found the attacker's email address, IP address and device fingerprints through records at an Asian crypto exchange.

On 11 August the attacker began to reply, in an unusual way: by writing messages into the data of small Ethereum transactions, which anyone could read. A series titled as a Q and A said the hack had been done "for fun", that returning the money had always been the plan, and that the point was to expose the bug before someone worse found it. Analysts at Elliptic and Chainalysis collected the notes as they appeared. Within days most of the coins had come back.

The last $141 million, 28,953 ether and 1,032 wrapped bitcoin, was more awkward. It was sent into a wallet that needed signatures from both Poly and the attacker to release, the crypto version of a joint bank account. Poly Network called its attacker "Mr. White Hat", hacker slang for someone who breaks in to help, offered a $500,000 "bug bounty" (a reward paid for finding a flaw), and invited them to become the project's Chief Security Advisor, adding that it had no intention of holding Mr. White Hat legally responsible. The attacker said he did not want the money. On 23 August he posted his key to the joint wallet in a public on-chain message, and Poly said every user asset taken had now been recovered. A later note signed "Your Chief Security Advisor" said the bounty had been handed back as well.

Why give back $611 million?

Nobody has proved a motive, and nobody has been named or charged. Three readings did the rounds. The first was that the hacker meant it, a genuine if reckless white hat. The second was that the whole affair was staged, which no evidence supports. The third, and the most widely held among investigators, was that the money had become nearly impossible to spend. Every coin was traced in public, every major exchange was watching the addresses, Tether had already frozen part of it, and SlowMist claimed to have identifying details. Turning $611 million of marked money into usable cash would have needed a laundering operation on the scale of a state, and this attacker did not appear to have one.

The bridge was robbed again

Poly Network did not get a happy ending. On 2 July 2023 an attacker used forged proofs, signed by three of the bridge's four keepers, to create billions of tokens out of thin air across several chains. On paper the minted tokens were worth $34 billion or more, but there was almost nobody to sell them to. The security firm Beosin estimated the attacker managed to turn about $10 million of them into ether. The analysis firm Dedaub found the keeper list had not changed in two years and said the keepers had signed a malicious message, whether through stolen keys or compromised software it could not tell. Poly took about seven hours to pause its contracts.

The 2021 hack opened the era of the bridge robbery. In the months that followed, Ronin lost $625 million and Wormhole $320 million, both through the same weak point: a small group of keys that a bridge trusts completely.