Poly Network attacker issues tokens that ‘did not exist’

The attacker found a vulnerability in Poly Network’s cross-chain bridge tool that seemingly permitted them to create huge amounts of tokens that “did not exist before”

Poly Network was hacked over the weekend by an attacker that used the interoperability platform to issue billions of tokens out of thin air.

The attacker found a vulnerability in Poly Network’s cross-chain bridge tool that seemingly permitted them to create huge amounts of tokens that “did not exist before,” tweeted 3z3 Labs founder Arhat.

Admitting that its platform had been attacked, Poly Network informed users on Sunday that its services had been suspended. Moreover, the platform stated that it was evaluating the extent of the attack and the assets affected.

Please stay calm, it added. We are committed to protecting your assets.

The hacker’s digital wallet held cryptocurrency worth around $43bln at one time following the hack, as per DeBank, the DeFi portfolio tracker. The figure was confirmed in a post shared by PeckShield, the blockchain data and security company.

Bridges are a vital part of Web 3’s ecosystem, letting users move assets between networks. Users who lock up tokens on one chain are issued an equal amount on another.

Bridges have traditionally been an attractive target for hackers, though.

On the layer-2 network Metis, attackers issued themselves around 100mln of BNB and $10bln of the Binance-branded stablecoin BUSD as part of the Poly Network hack, as per Chinese crypto journalist Colin Wu.

Around 100trln of Shiba Inu was issued on the network Heco. A considerable amount of altcoins were also issued on Polygon and Avalanche.

Metis stated that the BNB and BUSD tokens issued by hackers on its network are effectively unusable as “there is no sell liquidity available,” stopping any gains from being realized. The tokens have been locked by Poly Network as well, it added.

3z3 Labs’ Arhat admitted that the overall Poly Network attack was somewhat prevented because of lacklustre liquidity, which stopped any ill-gotten gains on Metis, but not on other networks such as Ethereum, where stolen tokens were exchanged on decentralized exchanges.

In spite of the scale of this hack, the hacker was only able to convert a small part of these tokens, Arhat added, estimating the attacker walked away with $400,000 worth of crypto. Everything else had no liquidity and were basically valueless.

The blockchain security company SlowMist stated the attacker’s total gains were higher. More than $4mln worth of digital assets from the hack has been “cashed in,” the company stated. This includes more than 1,500 Ethereum worth $3mln and 93bln SHIB worth $700,000.