$610 million in 34 minutes, DeFi's biggest theft in history

Original text author: Rhythm 0x29, 0x49

As the industry's enthusiasm focused on NFT, DeFi was stolen again, this time on a much larger scale than expected.

On August 10, Poly Network, a cross-chain protocol, was confirmed to have been stolen. O3 Swap, which uses this protocol, suffered a heavy loss. The assets on the three networks, Ethereum, Binance Smart Chain and Polygon, were almost wiped out. According to the browser, in 34 minutes, the hackers took 302 million USDT, 55,000 ETH, 2,000 Bitcoins and several other assets, with a total value of $610 million.

It should be noted that in 2020, there were more than 60 DeFi attacks, with a total loss of about 250 million US dollars. One attack of Poly Network was more than twice that of the whole year of 2020.

This is the largest theft in DeFi history.

Attack process

First, the hackers attacked Poly Network's Ethereum Cross Chain Manager Contract at: 0 x838bf9e95cb12dd76a54c9f9d2e3082eaf928270).

Poly Network Ethereum Asset Proxy Contract 0 x250e76987d838a75310c34bf422ea9f1ac4cc906) begin to hackers in transfers (address: 0 xc8a65fadf0e0ddaf421f28feab69bf6e2e589963) address.

According to BlockBeats, the Poly Network Ethereum Asset Broker contract made nine transfers to the hacker's address over a period of about half an hour, totaling about $260 million. The hacker took $610 million worth of tokens from ETH, BSC and Polygon in 34 minutes.

After the attack, the community discovered that the hackers may have taken assets across the chain pool through a "super back door." In fact, users discovered the problem three months before it happened. Weibo user "Kunlinyu" stated in May that O3 Swap has a one-button RUG function that allows users to transfer their pledged assets to a specific account with one click, and the contract does not have a time lock, which means that the transfer of assets does not require user permission.

A reality show for hackers

The loss of $600 million puts the hacker behind one of the most unusual attacks in history squarely in the spotlight, and the hacker seems to be enjoying it. The three attack addresses, which left traces on three networks, became his live channel with the rest of the world.

Because the amount of $610 million is so eye-catching, the major platforms and central asset parties responded actively to prevent hackers from taking advantage of the platform features to transfer the stolen money. To this end, in the on-chain transfer message, the hackers asked the world how to use Tornado.cash, an anonymous transfer platform on Ethereum, to mix coins.

Imagine a hacker who can steal $600 million in 34 minutes without even knowing how to use mixed coins. Anonymous transfer is the kind of knowledge that hackers must know by heart. Slow Mist said in the analysis of the attack that the hackers were initially funded by anonymous originator Monro coins.

Obviously, hackers are acting, arrogant hackers are using this channel to market themselves.

Two subsequent transfer messages tell the story, in which the hacker, in a defiant tone, said he was "lenient" by not taking all the assets in the agreement, and then "launched a DAO organization to determine the whereabouts of the assets."

Hackers are not a one-man show, countless visitors in the transfer record messages, hope hackers can share a bit of the stolen money. In fact, after every hacker attack, the exposed address has similar information, but after all, this is a $600 million historic attack, countless sleepless victims and apathetic spectators, this is another "dark forest".

What we can see are the investors who lost their assets in O3 Swap, but everyone in the industry was the victim of a multi-billion dollar attack, which deterred those who were prepared to try the DeFi market and those who were Smart Money professionals. This attack is a blow to the confidence of investors in O3 Swap, but also the confidence of traditional investors in DeFi. This is not only the largest attack by magnitude in DeFi history, but also perhaps a turning point for the DeFi industry.

The attack is not over yet, we will follow up any information about the attack in time. Once, the DeFi theft case of 25 million US dollars ended with the hacker returning all the assets. We hope that THE 600 million US dollars of O3 Swap can be returned to the investors as soon as possible.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia