Experts call the ‘$34 billion’ attack the new Poly Network exploit

On July 2, unknown attackers targeted the Poly Network cross-chain protocol and minted tokens worth tens of billions of dollars across several blockchains. The team paused the bridge’s operations.

\n

“Dear users, we would like to inform you that Poly Network is temporarily suspending its services due to the recent attack. We are actively engaging with the relevant parties and carefully assessing the extent of the affected assets,” the developers said.

\n

Cross-chain bridges allow transferring tokens between networks, locking assets in one and issuing in another. Supposedly, the hackers manipulated the smart contract that executes the operations.

multisignature addresses were used to control the smart contract. The attackers minted 10 billion BUSD and 100 million BNB (~$24.5 billion at the time) on Metis, 999 trillion SHIB on Heco and millions of tokens on other networks.

According to a preliminary assessment by the Poly Network team, the incident affected 57 different tokens across 10 blockchains.

According to PeckShield, at one point the hackers’ wallets held assets totaling $42.8 billion.

Experts note that the protocol team had used for two years a simple 3-of-4 multisig scheme.

Dedaub also noted that the Poly Network developers did not respond to the attack for seven hours. This allowed the hackers to sell assets worth about $5.5 million. A lack of sufficient liquidity across networks prevented a larger payoff.

The Metis team confirmed that, for this reason, the attackers had no way to realise the issued BUSD and BNB worth about $34.5 billion.

In August 2021, unknown attackers hacked Poly Network and withdrew $611 million in various cryptocurrencies. Over the course of a month the hackers returned all funds to the protocol and even the reward paid to them of 160 ETH (~$500,000 at the time).

In the first half of 2023, the crypto industry lost about $655.6 million due to hacks and fraud.