Poly Network $611M Hack event

Event · PageRank 0.0045

Also known as: Mr White Hat Hack

Overview

On 10 August 2021 an attacker exploited a flaw in Poly Network's cross-chain contracts — abusing the EthCrossChainManager's call routing to overwrite the bridge's keeper keys — and withdrew roughly $610 million in assets across Ethereum, BNB Chain and Polygon. It was the largest DeFi theft recorded at that point. The attacker began returning funds within a day, communicating publicly through on-chain messages, and effectively all of the assets were returned over roughly the following two weeks, making it also the largest hack-and-return event in DeFi history. The attacker's identity was never publicly established.

Within the DeFi Intel graph, Poly Network $611M Hack connects to 3 tracked entities, most strongly to Ethereum, Polygon, BNB Chain.

Relations

Top connections in the DeFi Intel knowledge graph (confidence-weighted, 3 of 3 total).

Frequently asked questions

How much was taken in the Poly Network hack?

Roughly $610 million across Ethereum, BNB Chain and Polygon on 10 August 2021 — the largest DeFi theft at the time.

How did the attack work?

The attacker abused the call routing in Poly Network's EthCrossChainManager contract to overwrite the bridge's keeper public keys with their own, granting withdrawal authority over locked assets.

Were the funds recovered?

Yes. The attacker began returning assets the next day and effectively all of the funds were returned over roughly two weeks, making it the largest hack-and-return event in DeFi.