Poly Network (2023) hack — July 2023

On 2 July 2023, at about 18:47 UTC, an attacker began issuing themselves tokens through Poly Network's cross-chain bridge. Dedaub's post-mortem concluded this was not a smart contract bug: the bridge relied on a 3-of-4 multisignature scheme held by four externally owned accounts that had gone unchanged for roughly two years, and the most likely explanation was that the private keys of three of the four keepers were stolen or misused. Dedaub added there was no definitive proof the keys were stolen and that a rug pull, or compromised off-chain software running on three keepers, were both possible. CertiK reached a similar conclusion, noting on-chain functions performed as intended and pointing to a private key compromise or an off-chain exploit. Poly Network took about seven hours to pause its contracts.

The notional amount minted was enormous but almost entirely unsellable. CertiK counted roughly $42 billion of assets issued across ten blockchains and 57 tokens; Dedaub described a $34 billion notional figure. More than $34 billion of Poly-pegged BNB and BUSD on Metis had no sell liquidity, and several projects pulled liquidity once the attack surfaced.

Realised proceeds are contested. A day after the attack crypto.news reported about $5.5 million actually taken. Beosin, cited by The Block, later counted about 5,196 ETH converted, roughly $10.1 million, and CertiK put the extracted amount at approximately $10 million. Ethereum, BNB Chain, Metis, Heco and Polygon were worst affected.

Poly Network suspended services, advised projects to withdraw liquidity from decentralised exchanges and appealed to the attacker to return the assets. No recovery or arrest has been reported. Poly Network announced in September 2024 that it was terminating all services on 30 September 2024, citing changing market conditions rather than the hack.