Poly Network Exploit Used Mint $34 Billion in Crypto Assets

Hackers have exploited the Poly Network cross-chain transport protocol to mint a reported $34 billion USD worth of assets on multiple chains.

The majority of the assets appear to be on Metis, an Ethereum Layer Two Network.

Insufficient Liquidity on Metis for Hackers to Cash Out

While hackers have minted billions in various tokens, the amount they may be able to cash out is likely far less.

As details of the exploit emerged on Sunday morning, the Metis DAO reported that there is insufficient liquidity available to sell the newly minted BNB and BUSD.

Despite the scale of the event, the DAO sought to reassure users that their funds on Metis Andromeda are safe.

Moreover, the DAO stated that:

“All minted METIS tokens from PolyBridge have been locked on BNBChain by PolyNetwork and have limited liquidity.”

Commenting on the incident, Binance’s CEO Changpeng Zhao said the exchange is unaffected. That’s because it does not support deposits from the Poly Network. Nonetheless, Zhao said that the Binance security team is helping Poly with its investigation.

As PolyNetwork, Metis, and other affected organizations scramble to freeze the newly minted assets, hackers are moving quickly to sell what they can. LookOnChain reported that a variety of assets had been swapped for ETH in an attempt to keep the hacked funds liquid.

Echoes of 2021 Poly Exploit

Sunday’s attack is not the first of its kind in the history of Poly Network.

A similar exploit affected the Poly network in August 2021. Then, hackers used the protocol to move $610 million USD worth of digital assets to wallets they controlled. 

After the attack, the Poly team asked exchanges and miners to help them track and freeze the stolen tokens. Players from across the industry were then able to work together to block the flow of assets. For example, Tether froze $33 million worth of USDT. 

In an open letter on Twitter, the Poly team urged the perpetrators to return the stolen tokens. Over the course of 15 days, all assets were returned to Poly Network.

Six days after the initial exploit, the hackers announced that they had been planning to return the tokens all along. They claimed that the purpose of the theft was to reveal vulnerabilities and improve the security of the Poly Network.