Group behind Poly Network, a cross-chain protocol used for DeFi applications, says a hacker has stolen $611M; one researcher blames the attack on a crypto flaw

Quick Take — Cross-chain protocol Poly Network has been hacked for $611 million. — The team behind the protocol …

The Block 2021-08-12 Tim Copeland

Context & Ripple Effects

Poly Network’s reported loss put cross-chain infrastructure at the center of a DeFi security failure, with the cited researcher attributing the breach to a crypto flaw. The subsequent story was unusual: the attacker began returning more than $342M in assets, and Poly ultimately said it had recovered the full amount for return to owners.

The episode also exposes a tension in DeFi’s operating model. Related coverage identifies multisig-controlled, upgradable smart contracts as a centralization risk—controls that can aid recovery but concentrate consequential authority.

First-order effects

Poly Network and the DeFi applications using its cross-chain protocol must contain the flaw and account for assets affected by the breach.
Users whose assets moved through Poly Network face an immediate recovery process rather than an assured on-chain settlement.

Second-order effects

Poly Network’s later $500K bounty offer and jointly controlled wallet arrangement made recovery dependent on off-chain negotiation and privileged controls, not solely on immutable contract behavior.
Other cross-chain DeFi operators face pressure to scrutinize upgrade and multisig arrangements, since those controls shape both breach exposure and the ability to intervene afterward.

Third-order effects

If cross-chain protocols continue pairing decentralized user access with concentrated emergency controls, DeFi’s credibility will hinge on whether those controls are transparent, narrowly governed, and resilient to compromise.
Large recoveries may soften immediate losses, but they also make governance design—not only smart-contract code—a core part of how users assess protocol risk.

The trend: Cross-chain DeFi is moving toward a harder trade-off between permissionless interoperability and the centralized safeguards used to contain failures.

Discussion

@polynetwork2 @polynetwork2 on x
So far, we have received a total value of $4,772,297.675 assets returned by the hacker. ETH address: $2,654,946.051 BSC address: $1,107,870.815 Polygon address: $1,009,480.809 https://twitter.com/...
@polynetwork2 @polynetwork2 on x
Dear Hacker, We are the Poly Network team. We want to establish communication with you and urge you to return the hacked assets. The amount of money you hacked is the biggest one in the defi history. Law enforcement in any country will regard this as a major economic crime and yo…
@paoloardoino Paolo Ardoino on x
. @Tether_to just froze ~33M $USDt on 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589 963 as part of the #PolyNetwork hack https://twitter.com/...
@cz_binance @cz_binance on x
We are aware of the https://poly.network/ exploit that occurred today. While no one controls BSC (or ETH), we are coordinating with all our security partners to proactively help. There are no guarantees. We will do as much as we can. Stay #SAFU. 🙏 https://twitter.com/...
@polynetwork2 @polynetwork2 on x
Important Notice: We are sorry to announce that #PolyNetwork was attacked on @BinanceChain @ethereum and @0xPolygon Assets had been transferred to hacker's following addresses: ETH: 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589 963 BSC: 0x0D6e286A7cfD25E0c01fEe9756765D8033B32 C71
@polynetwork2 @polynetwork2 on x
After preliminary investigation, we located the cause of the vulnerability. The hacker exploited a vulnerability between contract calls, exploit was not caused by the single keeper as rumored.
@polynetwork2 @polynetwork2 on x
https://twitter.com/...
@technollama Andres Guadamuz on x
Code is Law, they said. Trust the smart contract, they said. It will be fine, they said. https://twitter.com/...
@chainalysis @chainalysis on x
The response to this attack shows why it's so difficult to pull off large-scale crypto hacks these days. Yes, you may steal funds, but you'll have the entire crypto community monitoring the blockchains, making it extremely hard to actually access them. https://blog.chainalysis.co…
@o3_labs @o3_labs on x
This hacker might yet be of the white hat variety. Let's see. https://twitter.com/...
@wublockchain Wu Blockchain on x
Binance and circle need to explain why the 3m BUSD and 26m USDC stolen by hackers are not frozen. This case of the largest amount of money in DeFi history may have a great impact on confidence and supervision. @circlepay @jerallaire @binance https://twitter.com/...
@altnoaa Alternative Noaa on x
Dear Frank and Jesse James: The money you took belonged to hardworking people. You were bad. Please come talk to us and give it back. Warmly, First National Savings and Loan https://twitter.com/...
@davidgokhshtein David Gokhshtein on x
Cryptocurrency theft: Hackers steal $600 million in Poly Network hack https://www.cnbc.com/... Apparently they are going to send back the $600 million. #cryptocurrency #DeFi
@duediligenceguy @duediligenceguy on x
That's equivalent to around 343,000 ounces, or 10,665 kilos of #gold at current prices. Imagine how much more difficult that would be to steal... https://www.bbc.com/...
@layahheilpern Layah Heilpern on x
The responses to this is how we know we're still early! 🤣😂 https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Spoke with Poly Network. The company confirms this independent review of its hack from SlowMist is accurate: https://slowmist.medium.com/ ... https://twitter.com/...
@polynetwork2 @polynetwork2 on x
$342 million (As of 12 Aug 08:18:29 AM +UTC) of assets had been returned: Ethereum: $4.6M BSC: $252M Polygon: $85M The remaining is $268M on Ethereum
@polynetwork2 @polynetwork2 on x
$260 million (As of 11 Aug 04:18:39 PM +UTC) of assets had been returned: Ethereum: $3.3M BSC: $256M Polygon: $1M The remainings are $269M on Ethereum, $84M on Polygon
@rosexrp Xrp Rose on x
Well if ever I saw a better marketing campaign for a company, I'll be damned 🤣😂🤣 https://twitter.com/...
@ukmatc @ukmatc on x
@boxmining @PolyNetwork2 Not wanting to get your hopes up, but let's hope news of the hacker returning funds is true... https://www.theblockcrypto.com/ ...
@amhedh Amhed on x
This is wild... When have you ever read “criminal returns millions of dollars, because forensic tools are so good the hacker was identified in a day” in traditional finance? https://www.theblockcrypto.com/ ...
@michaelreuter @michaelreuter on x
In the histoty of traditional bank robbery - was the money ever returned (within 24hrs)? #crypto https://www.theblockcrypto.com/ ...
@sniko_ Harry.Eth on x
Hacker: “IT'S ALREADY A LEGEND TO WIN SO MUCH FORTUNE. IT WILL BE AN ETERNAL LEGEND TO SAVE THE WORLD. I MADE THE DECISION, NO MORE DAO” 0xd239b01026c49b234d075e3d23a07efd1c323 4239cfb440c0f90d5e84836fbe2 https://twitter.com/...
@sniko_ Harry.Eth on x
Hacker: “FAILED TO CONTACT THE POLY. I NEED A SECURED MULTISIG WALLET FROM YOU” 0x79245fb1d1ae48a214118e25d6ad2f9324f51 4ec6708135a19ba9d4cfa6344f6 Looks like intentions are to return everything? https://twitter.com/...
@sniko_ Harry.Eth on x
Hacker: “READY TO RETURN THE FUND!” 0x7b6009ea08c868d7c5c336bf1bc30c33b87a0 eedd59dac8c26e6a8551b20b68a https://twitter.com/...
@oscarwgrut Oscar Williams-Grut on x
Around $2m has been returned so far, including one transaction with the embedded message: “READY TO RETURN THE FUND!”
@noelleinmadrid Noelle Acheson on x
This is an extraordinary story - the biggest DeFi hack in history, forensics manages to track the perpetrator, the perpetrator voluntarily returns the funds... all this happening in public. Has anything like this ever happened in traditional markets? https://www.theblockcrypto.co…

Chronicles