$611M whitehat hack?
In the largest DeFi hack to date, an attacker drained over $611M from the Ethereum, Binance Smart Chain, and Polygon blockchains. Then in a surprise move, he returned almost all of it.
The hack was done by exploiting vulnerabilities on the Poly Network, a cross-chain interoperability protocol that connects different blockchains. These types of networks are usually among the most complex, owing to challenges in getting two different blockchains to talk to each other in a secure, safe fashion (it’s hard enough getting one blockchain to be secure!). And complexity is the enemy of security because added complexity increases the surface area for attackers to find exploits.
In this case, the hacker tricked Poly Network’s smart contracts into thinking that the hacker’s address had permission to unlock the $611M+ across chains (detailed technical analysis here, simple explainer here). But in an odd turn of events, the hacker ended up returning nearly all of it to the Poly Network team (sans $33M USDT frozen by Tether).
There remains speculation around the hacker’s motives to return the funds. Security firm SlowMist stated that they were able to identify the hacker’s IP and email addresses, so some think the funds were returned because the hacker knew they wouldn’t be able to launder that much money undetected. The hacker, on the other hand, conducted an AMA and stated that they did it, “for fun.” And in a separate twist, the Poly Network team offered the hacker a job as their Chief Security Officer in addition to sending a $500,000 bounty for returning some of the funds.
What’s going on here? We can’t know for sure, but it is rare for a hacker to return funds, especially in such a public fashion. Occam’s razor suggests that the repercussions involved with getting caught (if their info was truly identified) were too great to bear.
While it’s disconcerting to see more hacks happening, we should note that this is simply an evolutionary fitness-function in action. Each hack teaches us how to improve, and we learn, adapt, and improve. While bleeding edge crypto protocols pioneering new use cases will inevitably carry more risk, the space hardens over time.
And Poly Network is not alone. Note the other week when Paradigm’s samczsun discovered and reported a vulnerability in SushiSwap’s MISO platform that would have left $350M ETH at risk. Most recently, Cream Finance was exploited in a flashloan attack for $25M.
But for crypto to really succeed, we need security guarantees. Insurance markets are critical.