Tether Released the Final Frozen Funds From the Poly Network Exploit

Tether transferred 33,431,234.904931 USDT from its treasury to a Poly Network recovery wallet on August 25, 2021, removing the last frozen block of assets from the $610 million cross-chain exploit disclosed two weeks earlier. The successful Ethereum transaction was recorded at 12:22:49 UTC in block 13,094,547 and sent the tokens to the address Poly Network had designated for recovery.

The transfer mattered because it closed a gap that neither the attacker nor Poly Network could resolve solely through ordinary wallet signatures. Tether had frozen the USDT after the August 10 exploit. Unlike bitcoin or ether, USDT on Ethereum is an issuer-administered token whose contract can block addresses. That control stopped the stolen units from moving, then allowed Tether to direct equivalent units back through its treasury once the recovery process was approved.

The final on-chain leg

By August 23, Poly Network said the attacker it called “Mr. White Hat” had disclosed the private key needed for a jointly controlled multisignature wallet. Poly reported retrieving 28,953 ETH and 1,032 wrapped bitcoin, which it valued at about $141 million at that point. The protocol said it then controlled the affected assets other than the frozen USDT, while accounting and user restoration remained in progress.

The August 25 Ethereum record is more precise than the rounded company figure later published. Etherscan shows 33,431,234.904931 USDT moving from the labeled Tether Treasury address to the labeled PolyNetwork multisig. Poly Network’s subsequent account described the amount as 33,431,200 USDT. The roughly 34.9-token difference is a reporting precision issue; this reconstruction uses the token amount encoded in the transaction and treats Poly’s number as rounded.

The broader $610 million figure was Poly Network’s estimate of all assets affected across Ethereum, Binance Smart Chain and Polygon, not a cash loss measured at a single timestamp. Chainalysis separately estimated the original theft at $612 million and, at 12:45 p.m. Eastern on August 12, counted $578.6 million as returned while 33.4 million USDT remained frozen. Those totals use different valuation moments and rounding conventions, so they should not be combined into a new loss calculation.

What the recovery did—and did not—prove

The unusual return demonstrated two distinct forms of control inside decentralized finance. Public blockchains made transfers traceable and the attacker eventually surrendered access to most assets. At the same time, Tether’s contract-level powers supplied a centralized intervention for the USDT portion. The recovery therefore was not simply a triumph of immutable code; it depended on an issuer, a protocol team, a cooperative attacker and a multisignature handoff.

It also did not establish on August 25 that Poly Network was safe to use again. Asset recovery, vulnerability repair and service restoration were separate questions. Poly’s August 23 notice said cross-chain functions would resume gradually only after security confirmation, and accurate accounting still had to precede returning control to users. A successful recovery transaction did not independently verify the completeness of the patch or the claims the unidentified attacker made about motives.

Later-confirmed context

On August 26, 2021, Poly Network formally said it had completed recovery of all affected user assets and was moving from its “Asset Recovery” phase toward “Resuming Services.” Its September 2 review recorded that the affected WBTC and ETH were restored on August 25 and that Tether released the frozen USDT the same day.

Those later first-party statements clarify the operational sequence but do not change the event-day conclusion: on August 25, the remaining frozen USDT reached Poly Network’s designated multisignature wallet, while the security and service-restart work remained unfinished.