Partnered With:

Poly Network hackers use 12 questions and answers to outline their mental journey before and after the attack

Read this article in 7 Minutes

The hacker who attacked Poly Network answered a series of questions, such as why did you attack, why did you choose to attack Poly Network, and why did you repay

Poly Network Hacker Answers Why Attack Was Unexpected, No Tokens were Sold

Original text compilation: PANews

In the early morning of August 12, the hackers who attacked Poly Network posted a series of questions, such as why they attacked, why they chose to attack Poly Network, and why they paid back the money. Poly Network responded to the hackers by offering rewards when the remaining assets are returned and asking for an email address.

As of 8 a.m. on August 12, Poly Network attackers had returned more than $342 million worth of tokens (including USDC, BUSD, SHIB, and FEI) via BSC, Ethereum, and Polygon.

The following is the full text of the hacker q&A:

Q: Why the attack?

A: Just for fun.

Q: Why PolyNetwork?

A: Cross-chain attacks are hot.

Q: Why do you want to transfer tokens?

A: To ensure safety. I had mixed feelings when I discovered the mistake. Ask yourself what you would do if you were faced with so much wealth. Ask the project team politely so they can solve the problem? Anyone can be a traitor! I can't trust anyone! The only solution I could come up with was to keep it in a trusted account while keeping myself anonymous and safe.

Now everyone smells a conspiracy. The ghost? Not me, but who knows? It is my responsibility to expose the vulnerability before anyone on the inside can hide and exploit it!

Q: Why is it so complicated?

A: Poly Network is a good system. This is one of the most challenging attacks a hacker can enjoy. I had to beat any insider or hacker quickly and I took it as a reward challenge.

Q: Are you exposed?

A: no. By no means. I understand that I risk exposing myself even if I don't do evil. So I used a temporary email, IP or so-called fingerprint, which is untraceable. I'd rather be in the dark saving the world.

Q: What exactly happened 30 hours ago?

A: It's a long story. Believe it or not, I was forced to play this game.

Poly Network is a complex system and I did not manage to set up a local test environment. I didn't get to make POC at first. But just before I gave up, the AHA moment arrived. After debugging all night, I produced a SINGLE message for the ontology network.

I plan to launch a cool blitz to take over four networks: ETH, BSC, POLYGON and HECO. However, the HECO network is in error! The Repeaters behave differently than other Repeaters; the administrator simply relays my exploit directly, and the key has been updated with some wrong parameters. It ruined my plan.

I should have stopped at that moment, but I decided to let the show go on! What if they fix the leak secretly without any notice? However, I don't want to cause real panic in the crypto world. So I choose to ignore the junk coins, so people don't have to worry about them going to zero. I took the important tokens (except SHIB) and didn't sell any tokens.

Q: Then why sell/convert those tokens?

A: THE POLY team's initial response made me angry. Before I had a chance to reply, they urged others to blame and hate me! Of course I knew there were fake DEFI tokens but I didn't take them seriously as I had no plans to launder money. At the same time, saving the Curve earned some interest to cover potential costs, giving me more time to negotiate with the Poly team.

Q: Why do I need to tip 13.37 ETH?

A: I feel the warmth of the Ethereum community. I am busy investigating HECO problems and debugging my scripts. I think it's a network issue and why I can't deposit (I'm behind a complex agent). So I shared my kindness with the guy.

Q: Why TORNADO and DAO?

A: Having seen so many hacks, I knew that putting money into TORNADO was a wise but desperate decision. It defeats my purpose. Being a crowdsourced hacker after meeting so many beggars is just my joke.

Q: Why the refund?

A: That was always the plan! I'm not very interested in money! I know it hurts when people get attacked, but shouldn't they learn something from these hackers? I announced the refund decision just before midnight, so anyone who trusts me should rest;)

Q: Why are refunds taking so long?

A: I do need time to talk to the POLY team. I'm sorry. It's the only way I know how to prove my dignity while hiding who I am. I need a break.

Q: The Poly Network team?

A: I've started a brief conversation with them, and the logs are on Ethereum. I may or may not post them. The pain they suffered was temporary but unforgettable.

I want to give them tips on how to secure their networks so they can be qualified to manage billion-dollar projects in the future. Poly Network is a well-designed system that will handle more assets. They got a lot of new followers on Twitter, right?