Poly Hacker Issues $4 Billion Worth of Non-existent Tokens

Reading Time: 2 minutes
  • An attacker has manipulated Poly Network’s smart contract and issued non-existent tokens worth roughly $4 billion
  • The attacker issued the tokens on various blockchains such as Ethereum, Metis and Avalanche, with Shiba Inu forming the bulk of the imaginary coins
  • This is the second time the protocol is finding itself in the hands of a hacker after suffering another attack two years ago when malicious actors siphoned $600 million 

Poly Network has again been compromised by a malicious attacker who manipulated the platform’s smart contract to issue nonexistent tokens worth roughly $4 billion. The hacker issued the tokens on multiple blockchains such as Ethereum, Metis and Avalanche. This isn’t the first time the DeFi protocol is finding itself in the hands of a hacker having lost $600 million to an attacker in 2021.

From $42 Billion to $3 Million in 24 Hours

The bulk of the tokens consisted of Binance USD (BUSD) and Shiba Inu (SHIB) which were issued on the Metis and Heco blockchain respectively. Although the hacker’s wallet indicated that it contained assets worth over $42 billion moments after the act, the tokens’ value has since dropped to slightly above $3 million roughly 24 hours after the attack.


At the time of writing, 67% of the tokens were on Avalanche and 12% on BNB Chain. The Ethereum, OKC, Optimism, Gnosis Chain and Fantom blockchains held between 8% and 2% of the nonexistent tokens.

Although the lack of liquidity made the sale of most of the tokens impossible, the hacker didn’t leave empty-handed since he liquidated some of them for around 403 ETH currently worth close to $790,000.

Tokens Locked to Reduce Liquidity

Some affected blockchains like Metis have since locked their tokens to reduce their liquidity and thwart any attempts by the attacker to sell them. 

With a direct hack on a protocol being the most common way of siphoning funds from a decentralized entity, the latest Poly Network hack adds another way in which smart contracts and DeFi bridges can be compromised for financial gains.

Although Poly Network recovered all the funds stolen in 2021, the latest attack scheme complicates how affected users can recover their funds.