- Polter Finance has lost most of its funds to a malicious actor
- The attacker manipulated the protocol’s token pricing systems
- Polter has reached out to the attacker
Crypto lending protocol Polter Finance has lost most of its funds to an attacker who manipulated the platform’s token pricing systems. The attacker siphoned approximately $12 million leaving only $56,406. The platform has paused its services and contacted the exploiter through an on-chain message asking him to return the funds to avoid being pursued by law enforcement agencies, which doesn’t guarantee that the exploiter will return the funds.
Singapore Police Contacted
According to the platform’s pseudonymous creator Whichghost, the attacker exploited a weakness in a newly launched smart contract. Whichghost has reported the hack to the Singapore police, which may indicate that the attacker isn’t open to accepting part of the loot as a bounty.
A police report has been filed $POLTER exploit. https://t.co/rqgB3valrv
— polterfinance💥 (@polterfinance) November 17, 2024
The actual amount stolen from the network, however, differs between what Polter reported and what on-chain sleuths reported. According to blockchain investigators, the protocol lost roughly $7 million while Polter estimates the total amount lost to be approximately $12 million.
🚨ALERT🚨@PolterFinance has reported an exploit on the #Fantom chain. Over $7M in digital assets have been stolen!
Transaction: https://t.co/2sFDXiLkpm
💰 The attacker was originally funded via @TornadoCash on #Ethereum, with funds later bridged to #Fantom.
The team has taken… https://t.co/dYgVzDdsoh pic.twitter.com/N1u5sh7BPf— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) November 18, 2024
According to DeFiLlama, Polter had a TVL of $9.77 million on November 16 which plummeted to $730,000 on the day of the exploit on November 17. A day later, it dropped to $69,000. Analysis by on-chain sleuths indicates that the attacker was funded through coin-mixing service Tornado Cash.
Hacked Funds Deposited on Binance
The analysis further shows that the stolen funds were deposited on the Binance exchange. Polter disclosed that it’s “in the process of” involving law enforcement agencies.
Polter’s exploit comes a day after DeFi platform Thala disclosed that it managed to uncover its hacker’s identity and corner him to take a bounty in exchange for the stolen funds. It also comes four days after the Bitfinex hacker was sentenced to five years in prison.
Although Polter has offered to negotiate with the hacker, the hacker may choose to keep the entire loot even if their identity is revealed.
