Poly Network Hacker Says Exploit Was Just ‘For Fun’

Crypto’s largest heist continues to unfold like a cyberpunk reality show. In the latest episode, the hacker that stole around $600 million worth of crypto from cross-chain interoperability platform Poly Network conducted an AMA-style (Ask-Me-Anything) tell-all last night, answering questions about their motivations and plans.

In a strictly crypto fashion, the hacker kept it all on chain, embedding the questions and answers as “input data”—viewable as UTF-8—in Ethereum transactions sent to themselves.

And another… pic.twitter.com/HTFdM4w0s9

— Sam MacPherson (@hexonaut) August 11, 2021

The hacker explained that the exploit was meant to teach Poly Network a lesson. Returning the stolen funds was “always the plan,” they said.

“I am not very interested in money! I know it hurts when people are attacked, but shouldn’t they learn something from those attacks?”

At 12 am EST yesterday, the hacker announced that they were “ready to return the fund” also via an embedded message in an Ethereum transaction they sent to themselves.

“I announced the returning decision before midnight so people who had faith in me should had a good rest. ;),” the hacker said.

Since that announcement, the hacker has returned $342 million.

As to why they are returning the money “so slowly,” the hacker said they need time to negotiate with the Poly team. “It’s the only way I know to prove my dignity while hiding myself identity. [sic.]” And well, they also need a rest, the hacker said.

“In the meanwhile, depositing the stables could earn some interest to cover potential cost[s] so that I have more time to negotiate with the Poly team.”

“Now everyone smells a sense of conspiracy,” the hacker said, denying they’re an insider. “But who knows?” Elsewhere, the hacker called Poly Network a “decent” and “sophisticated system,” and signaled a willingness to help the platform become more secure.

Teaching a $600 million lesson

But the hacker resents the Poly Network for their antagonistic reaction right after the attack. “They urged others to blame & hate me before I had any chance to reply!,” the hacker protested.

In reply to a question about why they transfer tokens as they did, the hacker said the move was “to keep it safe.”

“When spotting the bug, I had a mixed feeling. Ask yourself what to do had you facing [sic.] so much fortune. Asking the project team politely so that they can fix it? Anyone could be the traitor given one billion. I can trust nobody! The only solution I can come up with is saving it in a trusted account.”

Two days ago, the hacker sent 13.37 ETH ($42,300) to hanashiro.eth, a pseudonymous twitter user, for tipping them off, “DONT USE YOUR USDT TOKEN YOU VE GOT BLACKLISTED.”

Someone asked the hacker why they would send that money. “I feeled [sic.] the warmth from the Ethereum community,” the hacker said. “I shared my goodwill [with] the guy.”

“Why hacking?,” someone asked. “For fun :),” replied the hacker. They targeted Poly Network because “cross-chain hacking is hot.”

Last month, ChainSwap, another cross-chain platform, fell victim to two multi-million dollar attacks. ChainSwap worked with the police and OKEx to try and identify the hackers, and managed to negotiate the recovery of some tokens. “Sorry for the trouble, you sound genuinely like great people but money is money,” the hackers of the earlier exploit told ChainSwap.

Poly Network’s hacker certainly appears more willing to cooperate than ChainSwap’s.

12 August 2021 12:22