The hacker who launched a $610 million attack on Poly Network‘s cross-chain decentralized finance (DeFi) system has almost entirely returned the money they stole, claiming their activities were “white hat.” According to an update on the assault by Poly Network, all $610 million in assets acquired through an exploit that leveraged “a vulnerability between contract calls” have now been moved to a multisig wallet under the control of the project and the hacker. The only tokens left are the roughly $33 million in Tether (USDT), which were locked as soon as the attack’s details were made public.
The hacker was using embedded messages in Ethereum transactions to communicate with the Poly Network team and other parties. They claimed to have carried out the breach “for fun” because “cross-chain hacking is popular”. And it is unclear whether they intended to transfer the monies after successfully taking them. However, the hacker refunded $258 million of the cash after meeting with the project and users. When Poly Network established that the attack qualified as “white hat conduct,” it called the hacker “Mr. White Hat” and awarded him a $500,000 reward.
They guarantee that you won’t be held responsible for this incident. They anticipate receiving all of the tokens back as soon as feasible. When the other items—all save the frozen USDT—are recovered, we will award you the 500k bounty. The poly did make a reward offer, but I never replied. I’ll return all of their funds instead, the hacker stated.
The remaining monies, with the exception of the frozen USDT, have now been recovered. It signals the conclusion of the largest hack in the history of decentralized finance. Apart from that, Chinese cybersecurity company SlowMist provided an update quickly after hearing about the incident, claiming that its experts have recognized the attacker’s identity, even though it has not yet been made public.