Home CoinNews Poly Network urges users to withdraw after exploit affects 57 crypto assets

Poly Network urges users to withdraw after exploit affects 57 crypto assets

by CoinNews

Further details are coming to light following a July 2 attack on cross-chain bridge platform Poly Network, with a hacker being able to issue billions of tokens out of thin air for profit.

In a July 2 tweet, Poly Network confirmed it became the latest decentralized finance (DeFi) exploit victim after attackers managed to manipulate a smart contract function on the cross-chain bridge protocol, adding it will be temporarily suspending services.

In the most recent update, the team revealed that the exploit affected 57 crypto assets on 10 blockchains, including Ethereum, BNB Chain, Polygon, Avalanche, Heco, OKX and Metis.

It did not specify how much was stolen in the attack, but PeckShield earlier reported that the exploiter had transferred out at least $5 million worth of crypto. A July 3 report from CertiK later estimated the attack led to around $10 million worth of crypto collected across five externally owned addresses. 

Tokens transferred out of Poly Network. Source: Twitter/PeckShield

“We have already initiated communication with centralized exchanges and law enforcement agencies and sought their assistance,” the team stated in a July 3 update.

It also advised project teams and tokenholders to withdraw liquidity and unlock their liquidity provider tokens.

’34 billion’ Poly Network hack breakdown

DeFi security analyst Arhat said the exploit resulted from a smart contract vulnerability that allowed the hacker to “craft a malicious parameter containing a fake validator signature and block header.”

This was accepted by the smart contract, enabling the hacker to bypass the verification process and allowing them to issue tokens from Poly Network’s Ethereum pool to their own address on other chains, such as Metis, BNB Chain, and Polygon.

The process was repeated for other chains enabling the token stash to pile up.

At one point, the hacker’s wallet held around $42 billion worth of tokens, but they were only able to convert and steal a fraction of them, said the analyst.

“This way, the hacker was able to mint billions of tokens on various blockchains that did not exist before and transfer them to their own wallet addresses.”

Blockchain security solutions provider Dedaub dubbed the latest Poly Network exploit the “34 billion Poly Network hack.”

Dedaub noted weaknesses in the protocol’s multisig, stating that it had a simple “3 of 4” multisignature arrangement over two years, adding:

“Looking at the final event we found that the private keys to the addresses marked were compromised.”

Dedaub explained that the attack wasn’t complex, as no logic bugs were exploited. It added that Poly Network took seven hours to respond, which cost the platform $5.5 million in stolen crypto. Luckily, a lack of liquidity in many of the tokens prevented further losses.

Related: Over $204M lost to DeFi hacks and scams in Q2

Following the attack, Binance CEO, Changpeng Zhao reassured customers, stating that “This does not affect Binance users. We do not support deposits from this network.”

Cointelegraph reached out to Poly Network for further details but received no response by publication.

In August 2021, the Poly Network was attacked in one of the industry’s largest-ever exploits. Hackers — later revealed to be linked with North Korean hacking collective, the Lazarus Group — made off with over $600 million.

Magazine: Tornado Cash 2.0: The race to build safe and legal coin mixers

Update (July 3, 11:02 pm UTC): Added information from a July 3 analysis from CertiK.