About the Poly Network hack

A cryptocurrency platform has lost an estimated $600 million in digital tokens in one of the the biggest ever cyberheists. Poly Network, a decentralized platform that facilitates peer-to-peer transactions, announced the hack on Twitter and posted details of digital wallets to which it said the money was transferred, urging people to blacklist tokens from those addresses.

The value of the tokens in the wallets cited by the platform was just over $600 million at the time of the announcement. Poly Network says it plans to take legal action and urged the hackers to return the stolen funds to several of its digital addresses.

The plea looked to be gaining some traction, with around $4.8 million in stolen tokens returned by Wednesday afternoon, according to public blockchain records and crypto tracking firm Elliptic. Analysts cited the headaches of laundering stolen crypto on such a scale as a possible motivation for the move.

The theft appeared to be one of the biggest ever in cryptocurrency markets, and was on a par with the $530 million in digital coins stolen from Tokyo-based exchange Coincheck in 2018. The Mt. Gox exchange, also based in Tokyo, collapsed in 2014 after losing half a billion dollars in bitcoin.

Poly Network allows users to swap tokens across different blockchains.

“It is a massive hack … as large as Mt. Gox,” said Bobby Ong, co-founder of crypto analytics website CoinGecko, although he noted the fallout had not yet hurt major crypto prices. “This project is finished in my opinion. (It is) going to take a lot to regain confidence.”

Technical details of the Poly Network hack

Address stolen funds were sent to

Stolen funds are located in these wallets:

Attacker ETH: 0xc8a65fadf0e0ddaf421f28feab69bf6e2e589963

Attacker BSC: 0x0D6e286A7cfD25E0c01fEe9756765D8033B32C71

Chains that were exploited

The hacker exploited the Proxy Lock Contracts of Poly Network on three different chains.

Ethereum:0x250e76987d838a75310c34bf422ea9f1ac4cc906

BSC:0x05f0fDD0E49A5225011fff92aD85cC68e1D1F08e

Polygon:0x28FF66a1B95d7CAcf8eDED2e658f768F44841212

Cryptocurrencies the hacker stole

On the Ethereum blockchain, the hacker stole

USDC – 96,389,444

WBTC – 1,032

DAI – 673,227

UNI – 43,023

SHIBA – 259,737,345,149

renBTC- 14.47

USDT – 33,431,197

wETH – 26,109

FEI USD – 616,082

On BSC, the hacker stole:

BNB – 6,613.44

USDC – 87,603,373

ETH – 299

BTCB – 26,629

BUSD – 1,023

On the Polygon blockchain, the hacker stole:

USDC – 85,089,610

The hacker’s communications with Poly Network

The attacker first turned to tornado.cash to launder the money. They sent this transaction which was found to be tied to FTX, Binance, and Okex accounts.:

Here is a summary of the hacker’s communications with Poly Network.

A technical brief explaining the hacker’s technique

“Poly has a contract called the “EthCrossChainManager”. It’s a privileged contract that has the right to trigger messages from another chain. It’s a standard thing for cross-chain projects.

It has a function named verifyHeaderAndExecuteTx that anyone can call to execute a cross-chain transaction.

It (1) verifies that the block header is correct by checking signatures (seems the other chain was a poa sidechain or) and then (2) checks that the transaction was included within that block with a Merkle proof. Here’s the code.

One of the last things the function does is call executeCrossChainTx, which makes the call to the target contract. This is where the critical flaw sits. Poly checks that the target is a contract, but they forgot to prevent users from calling a very important target… the EthCrossChainData contract

By sending this cross-chain message, the user could trick the EthCrossChainManager into calling the EthCrossChainData contract, passing the onlyOwner check. Now the user just had to craft the right data to be able to trigger the function that changes the public keys”