If you didn’t already think the world of crypto was interesting, maybe this incident will intrigue you.
$611 million stolen. 3 chains. 1 hacker. The biggest cryptocurrency hack in history.
Let me tell you a story, it’s an interesting one. It’s about the biggest heist ever in DeFi.
Poly White (the attacker) was sitting in his room and getting bored, when it occurred to him, that he could do what no man has done before. He exploited the Proxy Lock contracts of Poly Network (the company our main character hacked) on three different chains.
Stealing $611 million from one chain seemed too suspicious. And so, he split that amount. You know what they say, divide and conquer. Which is why, he hacked $273 million on Ethereum, $253 million on BSC, and $85 million on Polygon.
How did he do it? That’s one secret he’ll never tell…
What matters is, he had done it. But what’s next? Poly White has millions of dollar in crypto form but had no idea what do with it. He felt a rush of blood to his head.
Not long after the hack, he received a message from hanashiro.eth. It was a tip about how to handle USDT (also known as Tether, which is the stable coin in crypto. It’s aim is to keep cryptocurrency valuations stable). The tip actually helped White and out of generosity, he gave him 13.37 Ether for his help (that’s more than $40,000).
Everyone loves attention and money. Which is probably why he received messages for many others but none of them nearly as helpful or successful as hanashiro.eth.
That’s when things got real, but interesting, for White. Poly Network posted an open letter, begging him to return the finds, on Twitter.
He was unsure as to what he should do. He had $611 million on his computer and he just had to withdraw it to use it. Tronado.cash seemed like an obvious starting point to White. It’s a platform to improve transaction privacy by breaking the on-chain link between source and destination address. It accepts ETH deposits that can be withdrawn by a different address.
So he sent himself the transaction, along with a message: “Wonder why Tornado? Will miners stop me? Teach me please”
Suddenly, something inside White changed. He starting suggested that he might return “some tokens.” After all, his plan was to always return the money and he did this for fun. The pressure was too much and it wasn’t easy to keep his identity hidden. Finally, he announced that he was “READY TO RETURN THE FUND!”
A token called “The hacker is ready to surrender” was sent to Poly Network, who announced that they set up a multi-signature controlled by “known Poly addresses.” Hence, the white flag was raised and the process of returning $611 started.
But he wasn’t done playing this game… not so fast. In a five part-question answer session, he revealed three clues about his identity-
1) Not a native English speaker.
2) He’s a high profile hacker in the real world,
3) He has been devoted to a hacking career since a young age.
He invited the entire world to engage in a game with him:
IF ANY HACKER CAN FIND MY SOCIAL IDENTITY IN ONE MONTH, I WOULD LIKE TO SEND HIM MY PERSONAL GIFT. OTHERWISE, I MAY OR MAY NOT LEAK ANOTHER CLUE OF MY IDENTITY. SHALL WE PLAY THE GAME?
The Hacker in part-five of his Q+A
In the end, he was rewarded with $500,000 for ‘bug bounty.’ According to Economic Times, they thanked the hacker to help improve their security. Maybe honestly is the best policy.
That’s the end of this story for now. It’s about the Poly Network hacker but his identity remains unknown. He is a ‘White Hat,’ which means he’s an ethical hacker. Everyone’s calling him the ‘White Hat’ hacker and that’s why the name in my story, Poly White.
It was a DeFi hack. DeFi or decentralized finance, is a recreation of the traditional financing system, like loans, banks and exchange, with cryptocurrency. Most of them run on the Ethereum blockchain.
As of now, the entire amount hacked from BSC and Polygon chain have been refunded and almost all the funds have been refunded from the Ethereum chain.
No one is sure about how he was able to hack Poly Network, but there are a few theories. Mudit Gupta, Ethereum developer and security researcher, wrote that four people have access to the multisig wallet they use for transactions. Out of this three of them must sign it for a transaction to occur. He thinks, White Hacker got hold of at least 3 keepers and used it to change the requirements to a single keeper. Resulting in the Hacker locking them out. (Source: Decrypt)
SlowMist (the Blockchain security team) disagrees though. They believe White Hacker took advantage of a flaw in a smart contract function to change its keeper, rerouting the flow of funds to the attacker’s own address. (Source: report by SlowMist)
All we know about the hacker as of now, is from the questions he answered. But if you want to see a summary of the hacker’s communication with with Poly Network and the transfers and transactions, click here.
The Echo-nomist 
Leave a comment