The attacker who stole $611M from Poly Network has now returned over $256M in USDC, BTCB, SHIBA, and others, after saying they were “ready to surrender”
Quick Take — Poly Network attacker has started returning the funds that were stolen in the largest DeFi hack to date.
Context & Ripple Effects
Poly Network’s disclosure of a $611M theft from its cross-chain protocol set the scale of the incident. The first returned assets turn the story from a one-way loss into an active recovery effort.
Related coverage shows the recovery continuing to more than $342M returned and ultimately reaching a reported full recovery, while Poly also offered the attacker a bounty and used a jointly controlled wallet for remaining assets.
First-order effects
- Poly Network regains access to more than $256M in USDC, BTCB, SHIBA and other assets, reducing the immediate loss from the breach.
- The attacker’s stated surrender and initial transfers create a verifiable recovery path rather than leaving the stolen assets wholly outside Poly Network’s reach.
Second-order effects
- Poly Network’s response shifts from identifying the theft to managing asset return; the later bounty offer and jointly controlled wallet formalize that recovery process.
- The growing amount returned gives affected asset holders a clearer route toward restitution as Poly moves from loss disclosure to returning recovered funds.
Third-order effects
- The episode makes post-hack recovery a central part of cross-chain protocol risk management: security failures can become prolonged negotiations over control, custody and restitution rather than ending at the theft.
- If this response pattern is repeated, DeFi incident handling will be judged not only by prevention but by whether protocols can coordinate recoveries across the assets and chains involved.
The trend: DeFi security incidents are increasingly becoming operational recovery exercises, with custody arrangements and negotiated returns shaping the outcome after an exploit.