- An attacker has manipulated Poly Network’s smart contract and issued non-existent tokens worth roughly $4 billion
- The attacker issued the tokens on various blockchains such as Ethereum, Metis and Avalanche, with Shiba Inu forming the bulk of the imaginary coins
- This is the second time the protocol is finding itself in the hands of a hacker after suffering another attack two years ago when malicious actors siphoned $600 million
Poly Network has again been compromised by a malicious attacker who manipulated the platform’s smart contract to issue nonexistent tokens worth roughly $4 billion. The hacker issued the tokens on multiple blockchains such as Ethereum, Metis and Avalanche. This isn’t the first time the DeFi protocol is finding itself in the hands of a hacker having lost $600 million to an attacker in 2021.
From $42 Billion to $3 Million in 24 Hours
The bulk of the tokens consisted of Binance USD (BUSD) and Shiba Inu (SHIB) which were issued on the Metis and Heco blockchain respectively. Although the hacker’s wallet indicated that it contained assets worth over $42 billion moments after the act, the tokens’ value has since dropped to slightly above $3 million roughly 24 hours after the attack.
It seems that #PolyNetwork was attacked again, hackers minted a lot of assets.
Hackers have sold 94B $SHIB for 360 $ETH, 495M $COOK for 16 $ETH and 15M $RFuel for 27 $ETH.
And we noticed that hackers are transferring assets and 1 $ETH to new wallets, most likely for sale. pic.twitter.com/a8eqbgy1Vm
— Lookonchain (@lookonchain) July 2, 2023
At the time of writing, 67% of the tokens were on Avalanche and 12% on BNB Chain. The Ethereum, OKC, Optimism, Gnosis Chain and Fantom blockchains held between 8% and 2% of the nonexistent tokens.
Although the lack of liquidity made the sale of most of the tokens impossible, the hacker didn’t leave empty-handed since he liquidated some of them for around 403 ETH currently worth close to $790,000.
Tokens Locked to Reduce Liquidity
Some affected blockchains like Metis have since locked their tokens to reduce their liquidity and thwart any attempts by the attacker to sell them.
All minted METIS tokens from PolyBridge have been locked on BNBChain by PolyNetwork and have limited liquidity.
— Metis 🌿 (@MetisDAO) July 2, 2023
With a direct hack on a protocol being the most common way of siphoning funds from a decentralized entity, the latest Poly Network hack adds another way in which smart contracts and DeFi bridges can be compromised for financial gains.
Although Poly Network recovered all the funds stolen in 2021, the latest attack scheme complicates how affected users can recover their funds.
