Hackers are always after places that store sensitive information or money. Hackers are after decentralized finance systems because of the latter.
Poly Network is China-based blockchain protocol.
The company experienced quite a rollercoaster ride, when it reported than it lost more than $600 million in customers' funds in the form of cryptocurrency. The company lost it because of a hack.
The hacker reported the exploit, and then returned the looted cryptocurrency to Poly Network, but $33 million less.
The hacker didn't provide the key to unlock the remaining fund.
“There are users who are panicking that they might lose control of their assets, and we want to minimize the impact on them, so restoring our network and our users’ assets in a secure manner as quickly as possible is our top priority,” the Poly Network team said.
— Poly Network (@PolyNetwork2) August 10, 2021
Aug-19 12:55:49 AM +UTC#mrwhitehat returned 96,942,063 DAI on Ethereum. 28,953 ETH and 1,032 WBTC still remain in multi-sig wallet. As we promised, 160 ETH Bounty(worth $500K) has been donated. Please check it here https://t.co/uoKB8vjyQX
— Poly Network (@PolyNetwork2) August 19, 2021
The story began in August 10, when a hacker, identified in the Ethereum-blockchain explorer website Etherscan as “Poly Network Exploiter 1,” managed to exploit a weakness at Poly Network
With that, the hacker managed to steal a sum considered the biggest-ever in decentralized finance to date.
The hacker then returned most of the funds to a special wallet set up for the purpose, but withheld the rest.
About 33 million of the dollar-linked stablecoin tether (USDT, +0.21%) is frozen, according to Poly Network.
A subsequent message posted on Ethereum and signed “Poly Network Team,” the company said that “we still hope you can provide the key to us this week, because thousands of users are waiting to get their assets back.”
The communication from the hacker indicates that the hacker has no qualms in holding onto the stolen coins for an indefinite period.
However, the hacker wanted to wait.
"I am not ready to publish the key in this week [sic]… Here is one thing that you can always trust me: [sic] Holding BTC and ETH is better than trading them," the hacker said.
To make it comfortable for the hacker, Poly Network even called the hacker a "White Hacker," a term specifically reserved for 'good' hackers who discover bugs and help developers patch vulnerabilities.
Poly Network offered a bounty worth nearly $500,000 to the hacker, and even invited the hacker to become its "chief security advisor."
Poly Network also said that it "has no intention of holding Mr. White Hat legally responsible" for the hack.
"Your essays are very convincing while your actions are showing your distrust, what a funny game. You don’t [sic] even think to unlock my USDT account," said the hacker
“Although we did not receive a positive response from Mr. White Hat, we still fulfilled our promise and credited 160 ETH (worth about $500,000) to the address Mr. White Hat had made public,” the Poly Network team said.
Because of the delay, Poly Network project had to gradually restart suspended operations, with full functionality restored for at least 31 assets including Binance Coin (BNB), Uniswap (UNI) and Shiba Inu (SHIB), according to the team.
#PolyNetwork has no intention of holding #mrwhitehat legally responsible and cordially invites him to be our Chief Security Advisor. $500,000 bounty is on the way. Whatever #mrwhitehat chooses to do with the bounty in the end, we have no objections. https://t.co/4IaZvyWRGz
— Poly Network (@PolyNetwork2) August 17, 2021
Not only that the hacker stole the largest amount ever in the decentralized finance history, the hacker also managed to cover his tracks.
Because of this, Poly Network has no choice but to be on the hacker's good side, or risk having the funds lost forever.
"We will still proactively stay in communication with Mr. White Hat,” Poly Network said.
“We believe that the sooner we assure him that Poly Network is recovering with security as the top priority, and in an organized manner, the sooner we can gain his trust and eventually obtain his private key.”
“Poly Network is actively communicating with Tether on how to deal with this USDT is also a serious and careful decision making process for Tether,” the Poly Network team wrote.
“We are confident there will be a clear result soon, as we need this assets in order to perform full asset recovery.”
“The sooner the asset recovery can be carried out, the more negative emotions will be avoided. We are unlikely to get a proper rest until we fully return the user assets.”
