Poly Network: the hacker takes more than 600 million... then returns the assets

On August 10, 2021, assets valued at approximately $610 million left Poly Network. They circulated through a system linking several blockchains. The platform is faced with a huge anomaly: mechanisms supposed to control movements have accepted illegitimate operations.

Technical analyses describe a poor separation of rights between contracts that handle messages and maintain control information. An operation can influence an authority that it should not change. The flaw is about the rules of the program, not about making bitcoins without limits.

Poly Network requires platforms and industry players to report or block assets. Tether freezes some of the affected tokens. Public movements make it possible to follow the spoils; they do not, by themselves, provide the civil identity of the person who controls the addresses.

Then the case changes direction. The attacker begins to return funds and exchanges messages on the blockchain. The restitutions are made in several stages, in particular by devices requiring several keys. A transfer to a common address does not yet mean that users can immediately get their money back.

Subsequent analysis and announcements describe the return of virtually all assets. The attacker presents his own version of his intentions. It is not an independent proof that it was an altruistic gesture from the start, nor is it an authorization to take the funds away.

This case is remarkable for its size and its unusual outcome. The return of assets does not remove the flaw that made it possible: the defense of a system also depends on the powers it grants to its own components.