Poly Network Attacker Returns $260 Million After Record DeFi Exploit

Poly Network said on August 11, 2021 that the attacker behind its approximately $613 million cross-chain exploit had returned about $260 million in digital assets. The recovery covered more than one-third of the value reported stolen on August 10, but approximately $353 million remained outstanding at the event-day cutoff.

The reversal was visible on public blockchains rather than solely through a company announcement. It also turned an already exceptional security failure into a test of whether transparent ledgers, token controls and industry coordination could constrain an attacker after funds had left a protocol.

The return begins on-chain

At 03:48:18 UTC on August 11, an Ethereum transaction from the address identified as the Poly Network exploiter carried the message “READY TO RETURN THE FUND!” The transaction transferred no ether, but its signed input established that whoever controlled the labeled address was communicating from it.

Poly Network subsequently supplied collection addresses on Ethereum, Binance Smart Chain and Polygon. In a later first-party chronology, the protocol said it began recovering the first returned assets at 08:43:57 UTC on August 11. That retrospective timestamp is consistent with the dated transaction record, although it was published after the event and should not be treated as an independently contemporaneous account.

By Poly Network’s late-August 11 update, the reported return consisted of approximately $256 million in Binance Smart Chain assets, $3.3 million in Ethereum assets and $1 million on Polygon. Those figures were dollar-value estimates reported by the protocol and repeated by contemporaneous news organizations. They were rounded snapshots of multiple tokens, not cash proceeds, audited balances or measurements of the protocol’s permanent loss.

A cross-chain security failure

Poly Network allowed users to move or exchange token representations across otherwise separate blockchains. Chainalysis attributed the loss to an exploit in the smart contracts used to execute those cross-chain transactions and identified attacker-controlled addresses on Ethereum, Binance Smart Chain and Polygon.

That architecture made the incident institutionally important. A defect in cross-chain authorization could expose assets represented across several networks at once, while recovery depended on coordination among the protocol, token issuers, exchanges, security researchers and blockchain-monitoring firms.

Tether had frozen roughly 33.4 million USDT associated with the exploit. Other industry participants said they were monitoring the identified addresses. These measures illustrated that DeFi transactions could be publicly traceable and, for centrally issued tokens, subject to issuer intervention. They did not demonstrate that the underlying contracts were secure or that all affected users could immediately recover their assets.

What remained unknown on August 11

The controller of the attacker addresses had not been publicly identified. Messages attributed to that controller claimed the exploit was intended to expose a vulnerability and that returning the assets had always been planned. Reuters said it could not authenticate those assertions, and the signed messages proved control of an address—not the writer’s identity, motives or legal status.

The $260 million return therefore reduced the amount immediately at risk without resolving the incident. On August 11, the remaining assets had not all been returned, the protocol’s restoration process was incomplete, and the consequences for users were still developing.

Later context

Poly Network’s September 2021 postmortem said all affected assets were ultimately restored within 15 days. That outcome was not knowable on August 11 and does not alter the uncertainty appropriate to the event-date account.