Blockchain security firm SlowMist says the attacker behind a $611 million hack of Poly Network left a trail of digital fingerprints revealing the details of the massive crypto heist.
Poly Network, a project that enables the swapping of tokens across different blockchains, tells its 16,400 Twitter followers that its system was breached on Tuesday.
Through on-chain and off-chain tracking, SlowMist says that they have identified the attacker’s mailbox, IP address and device fingerprints. The blockchain security company also highlights that the attacker initially used Monero (XMR), which were later exchanged for Binance Coin (BNB), Ethereum (ETH) and Polygon (MATIC). According to SlowMist, the three crypto assets were used to fund the hack.
SlowMist adds that the attacker appears to have been preparing for the attack for quite some time based on the use of multiple fingerprint information and the movement of funds.
Looking at the Poly Network attack, security researcher and Ethereum developer Mudit Gupta notes the event does not appear to be a typical decentralized finance hack.
“This was not a DeFi or smart contract hack but a traditional key compromise combined with irresponsible design decisions taken by Poly Network… It seems like they used a single keeper. That keeper had control over all of the funds. The hacker probably got hold of that keeper’s key via traditional hacks…
The hacker used the keeper’s key to sign instructions that ordered the smart contract to transfer all funds to the hacker. The smart contract verified the signature and since only one signature was required, it processed the request.”
In a letter addressed to the hacker, Poly Network urges the cybercriminal to return the stolen funds.
“The amount of money you hacked is the biggest one in DeFi industry. Law enforcement in any country will regard this as a major economic crime and you will be pursued…
You should talk to us to work out a solution.”
Don't Miss a Beat – Subscribe to get email alerts delivered directly to your inboxFeatured Image: Shutterstock/GrandeDuc