Partnered With:

Certik: Analyzing the Poly Network's multi-million dollar loss attack incident.

Read this article in 10 Minutes

This incident appears to be the largest hacking attack in terms of the amount involved in history, but the actual profit gained by the hackers is much lower.

Source: Certik

On July 1, 2023, an attacker exploited a vulnerability in Poly Network to mint assets worth $42 billion across multiple chains. Despite the large amount of assets issued, the attacker was unable to withdraw more than $10 million from 5 external account addresses due to low liquidity and frozen project tokens.

This is the first cross-chain bridge attack incident that happened this year, and it is also the second attack against Poly Network. The total loss amount of last year's attack incident reached 3.7 billion US dollars, of which the loss caused by cross-chain bridge attacks accounted for 35%. Although this incident seems to be the largest vulnerability attack event in history in terms of the amount involved, the actual profit of the hacker is much lower.

Event Summary

On July 1, 2023 at 14:47 Beijing time, a malicious actor transferred assets from Poly Network's Lock Proxy contract to the attacker's address through several cross-chain bridge transactions. From the records, the attacker profited over $42 billion worth of assets from 10 different chains.

Image: Poly Network attacker's wallet address. Source: Debank.

However, in reality, this number is misleading. For example, the attacker holds over 34 billion Poly-pegged BNB and BUSD on the Metis blockchain, but these tokens cannot be sold due to lack of liquidity. Later, Metis confirmed in a tweet that the newly minted BNB and BUSD have no available liquidity and are therefore worthless.

Similarly, a large number of remaining tokens have become worthless. Upon hearing about this incident and the tokens issued by the attacker, several projects promptly took action to remove liquidity to prevent token dumping and price collapse. For example, OpenOcean, StackOS, Revomon, and NEST all canceled the liquidity of their projects to prevent the attacker from selling.

Revomon Twitter

Although the $42 billion figure does not accurately reflect the losses caused by this incident, CertiK has confirmed that at least $10 million in assets were stored in 5 Ethereum wallets.

Cross-chain bridge vulnerability

In 2022, security incidents affecting cross-chain bridges resulted in economic losses of $1.3 billion, caused by only five incidents. This highlights the destructive power of cross-chain bridge security vulnerabilities. Protecting cross-chain bridges is difficult, as they have significant value and various attack paths that can be exploited, making them a prime target for malicious actors. Cross-chain bridges consist of multiple components, including custodians, issuers, and oracles. Due to the large amount of funds locked on the bridge, any misconfiguration, vulnerability, or malicious exploitation can result in significant losses.

Attack Process

Poly Network uses the "Lock" and "Unlock" functions to bridge assets between different networks. Users must first "Lock" their tokens on the source chain before they can "Unlock" them on the target chain.

The following example is based on cross-chain transfer from BSC to ETH.

The attacker first calls the Lock function on the BSC network to initiate a cross-chain transfer of a small amount of 8PAY tokens.

Image: The attacker used a small amount of 8PAY tokens to initiate cross-chain transfers. Source: Etherscan

In this transaction, the data is designated as "0x4a14feea0bdd3d07eb6fe305938878c0cadbfa16904214e0afadad1d93704761c8550f21a53de3468ba599e80300000000000000000000000000" starting with the four bytes "0x4a" representing the data length.

「0x14feea0bdd3d07eb6fe305938878c0cadbfa16904214e0afadad1d93704761c8550f21a53de3468ba59900e00fc80b54905e35ca0d000000000000000000000000000000000000000000」

In this transaction, the quantity of 8pay tokens significantly increased.

The attacker repeated this process according to the above steps. There are 57 tokens involved, distributed across 11 different blockchains. The attacker profited approximately $42 billion in assets (calculated at face value).

Image: Tokens unlocked by the Poly Network attacker on Ethereum. Source: Etherscan

Asset Tracking

On the Ethereum network, the attacker successfully converted some tokens into ETH. The process is as follows:

The attacker transferred the remaining token assets to a new EOA address and transferred 1 ETH to each address (although they have not yet cashed out these tokens). As the project owner removed liquidity from the tokens to prevent dumping, some tokens became worthless. So far, the attacker seems to have only gained about $10 million from the incident.

Image: The Poly Network attacker transferred assets and 1 ETH to a new EOA address.

At the end

In 2022, the Web3.0 ecosystem experienced devastating impacts from cross-chain bridge attacks, affecting projects such as Ronin Bridge, Wormhole, and Nomad. The initial detection results of the Poly Network incident showed that this was the largest security event encountered by the Web ecosystem so far, but due to the lack of liquidity support for newly minted tokens, the loss has been controlled at approximately $10 million at the time of writing. There is currently no exact consensus on how the attacker exploited Poly Network. However, preliminary indications suggest that it may be due to private key leaks or off-chain vulnerabilities, as on-chain functionality was running normally.