Poly Network hack — August 2021
Incident facts
| Date of incident | |
|---|---|
| Target type | Cross-chain bridge |
| Loss | $611,000,000Price at time of incident |
| Recovered | $611,000,000 |
| Method | Access control flawCross-chain manager contract could be instructed to change its own keeper |
| Chains | Ethereum, BNB Chain, Polygon |
| Outcome | Funds returned |
What happened
Poly Network, a protocol for moving assets between chains, lost about $611m on 10 August 2021 across Ethereum, Binance Smart Chain and Polygon. It remains one of the largest thefts on record and also one of the few that ended with the money coming back.
The attacker was able to make the protocol's cross-chain manager execute a message that changed the address authorised to approve transfers. With that authority, withdrawing the pooled assets required no further exploit.
Within a day the attacker began returning funds, eventually sending back everything except $33m of USDT that Tether had frozen. Messages left in transaction data described the attack as having been carried out to expose the vulnerability rather than to profit from it. Poly Network offered a $500,000 bounty and a security advisory role; the bounty was declined.
Because the funds were returned rather than recovered by force, this entry records the full amount taken alongside the full amount returned. No attribution was ever established, and no charges are known to have been brought.
Sources
- BlockworksSecondary · retrieved 2026-08-01
- ITV NewsSecondary · retrieved 2026-08-01
- ImmunefiSecondary · retrieved 2026-08-01
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Poly Network hack — August 2021", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/poly-networkhttps://itokenly.com/hacks/poly-networkPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.