Incident reportBridge exploitEthereum, BSC, Polygon

Poly Network −$611M

The hacker gave it back, got offered a job, and turned it down.

A flaw in Poly Network's cross-chain contracts let an attacker move about $611 million across three chains, the biggest DeFi theft at the time.

Aug 10

Funds are drained across Ethereum, BSC and Polygon.

Aug 11

The attacker starts returning funds, posting messages inside transactions.

Aug 23

Nearly everything is back. Poly Network offers the attacker a security job and a bounty.

Almost all of the money was returned. The attacker, nicknamed 'Mr. White Hat', declined the job.

Date2021-08-10

Lost$611M

WhoAn anonymous attacker who called it a joke

We'd like to offer you the role of Chief Security Advisor.

Lesson The best security plan should not be the attacker's conscience.