The attacker who stole $611M from Poly Network has now returned over $342M in USDC, BTCB, SHIBA, and others, after saying they were “ready to surrender”

Quick Take — Poly Network attacker has started returning the funds that were stolen in the largest DeFi hack to date.

The Block 2021-08-12 Wolfie Zhao

Context & Ripple Effects

The incident began with a $611M theft from the cross-chain protocol, then moved quickly from an initial return of more than $256M to a larger repayment. That progression turns the story from a loss event into an active recovery process.

The later record shows Poly Network ultimately recovered all of the stolen cryptocurrency and began returning it to rightful owners. A $500,000 bounty offer and jointly controlled wallet show the recovery was being handled through negotiation as well as technical containment.

First-order effects

Poly Network regains control of more than $342M in USDC, BTCB, SHIBA and other assets, reducing the amount still held by the attacker.
Affected asset holders have a clearer route to restitution as recovered funds move back under Poly Network’s control.

Second-order effects

Poly Network’s $500,000 bug-bounty and joint-wallet arrangement creates a concrete incentive and custody mechanism for recovering the remaining assets.
Other DeFi protocols facing exploits gain a visible recovery playbook centered on tracing assets, negotiating their return, and coordinating custody rather than treating an on-chain theft as immediately irreversible.

Third-order effects

The episode points toward security incident response becoming a core operating function for cross-chain DeFi protocols, alongside preventive code security.
If negotiated recoveries become more common, protocol teams, token holders, and attackers will face incentives shaped not only by exploits but also by bounty terms and control of recoverable wallets.

The trend: DeFi security response is evolving from post-exploit loss disclosure toward active asset recovery using on-chain traceability, negotiated bounties, and shared custody arrangements.

Discussion

@polynetwork2 @polynetwork2 on x
$342 million (As of 12 Aug 08:18:29 AM +UTC) of assets had been returned: Ethereum: $4.6M BSC: $252M Polygon: $85M The remaining is $268M on Ethereum
@polynetwork2 @polynetwork2 on x
$260 million (As of 11 Aug 04:18:39 PM +UTC) of assets had been returned: Ethereum: $3.3M BSC: $256M Polygon: $1M The remainings are $269M on Ethereum, $84M on Polygon
@rosexrp Xrp Rose on x
Well if ever I saw a better marketing campaign for a company, I'll be damned 🤣😂🤣 https://twitter.com/...
@ukmatc @ukmatc on x
@boxmining @PolyNetwork2 Not wanting to get your hopes up, but let's hope news of the hacker returning funds is true... https://www.theblockcrypto.com/ ...
@amhedh Amhed on x
This is wild... When have you ever read “criminal returns millions of dollars, because forensic tools are so good the hacker was identified in a day” in traditional finance? https://www.theblockcrypto.com/ ...
@michaelreuter @michaelreuter on x
In the histoty of traditional bank robbery - was the money ever returned (within 24hrs)? #crypto https://www.theblockcrypto.com/ ...
@sniko_ Harry.Eth on x
Hacker: “IT'S ALREADY A LEGEND TO WIN SO MUCH FORTUNE. IT WILL BE AN ETERNAL LEGEND TO SAVE THE WORLD. I MADE THE DECISION, NO MORE DAO” 0xd239b01026c49b234d075e3d23a07efd1c323 4239cfb440c0f90d5e84836fbe2 https://twitter.com/...
@sniko_ Harry.Eth on x
Hacker: “FAILED TO CONTACT THE POLY. I NEED A SECURED MULTISIG WALLET FROM YOU” 0x79245fb1d1ae48a214118e25d6ad2f9324f51 4ec6708135a19ba9d4cfa6344f6 Looks like intentions are to return everything? https://twitter.com/...
@sniko_ Harry.Eth on x
Hacker: “READY TO RETURN THE FUND!” 0x7b6009ea08c868d7c5c336bf1bc30c33b87a0 eedd59dac8c26e6a8551b20b68a https://twitter.com/...
@oscarwgrut Oscar Williams-Grut on x
Around $2m has been returned so far, including one transaction with the embedded message: “READY TO RETURN THE FUND!”
@noelleinmadrid Noelle Acheson on x
This is an extraordinary story - the biggest DeFi hack in history, forensics manages to track the perpetrator, the perpetrator voluntarily returns the funds... all this happening in public. Has anything like this ever happened in traditional markets? https://www.theblockcrypto.co…

Chronicles