In this lesson
- find out how one hacker took about 610 million dollars from a cross-chain protocol
- see why "Mr. White Hat" gave the money back and what he got offered for it
- learn what this case says – and does not say – about getting stolen crypto back
What happened to Poly Network? On 10 August 2021 an anonymous hacker exploited a flaw in Poly Network, a protocol for moving tokens between blockchains, and took over 610 million dollars in crypto on Ethereum, BNB Chain and Polygon – at the time the largest theft in decentralised finance. Within two weeks the hacker returned practically everything; only about 33 million dollars in USDT stayed frozen by Tether. Poly Network nicknamed the hacker "Mr. White Hat" and offered a 500,000-dollar reward and a job as chief security advisor. Nobody has been charged as of October 2026.
Most thieves avoid talking to their victims. This one held a public Q&A session – written into blockchain transactions, for the whole world to read.
How did the attack work?#
Poly Network was a bridge between many blockchains. On each chain it had contracts holding users' tokens. Withdrawals were approved by a small list of trusted signers called keepers: if the keepers confirmed "this person locked tokens on chain A", the contract on chain B paid out.
- A manager contract accepted cross-chain messages and could execute almost any function that a message asked for.
- That same manager contract had the right to change the list of keepers.
- The attacker crafted a message that made the manager call the "change keepers" function – and replaced the real keeper with their own key.
- Now the attacker was the keeper. They approved withdrawals to themselves on several chains, one after another.
In short: the attacker did not steal the keys to the vault. They convinced the vault to accept their key as the official one. One badly limited permission in a smart contract was enough.
Why did the hacker give the money back?#
Within hours, things started going wrong for the attacker:
- Everything was visible. Every movement of the coins was public on the blockchains. Exchanges and analysts watched the addresses.
- Freezes. Tether froze about 33 million dollars of USDT, because USDT is a centrally controlled stablecoin. Other projects and exchanges promised to block the addresses.
- Traces. The security firm SlowMist said it had found the attacker's email address, IP address and device fingerprints.
- A public appeal. Poly Network published an open letter to the hacker asking for the money back.
The hacker answered in messages written into transactions. They claimed they had done it "for fun", that "cross chain hacking is hot" and that they were "not very interested in money". From 11 August the coins started coming back. The last part was locked in a wallet that needed both Poly Network's and the hacker's key; on 23 August the hacker published their key and Poly Network regained control.
Poly Network went from "we will pursue you" to calling the attacker "Mr. White Hat", offering a 500,000-dollar bounty and the post of chief security advisor. The hacker said they would not take the bounty. Whether they ever started the job is not known – which, for a security advisor, is a strange kind of discretion.
Timeline#
| Date | What happened |
|---|---|
| 10 August 2021 | The attacker takes over 610 million USD from Poly Network on three blockchains |
| 10 August 2021 | Poly Network publishes an open letter; Tether freezes about 33 million USDT |
| 11 August 2021 | In on-chain messages the hacker says it was "for fun"; the first coins come back |
| 13 August 2021 | About 340 million USD is back; the rest sits in a shared wallet |
| 23 August 2021 | The hacker publishes the last key; practically everything is returned |
Other hacks that ended with a refund#
Poly Network is not the only case. In March 2023 the lending protocol Euler Finance lost about 197 million dollars in a flash loan attack. Euler offered the attacker a deal on-chain and later a 1-million- dollar reward for information leading to them. By early April 2023 the attacker had returned all recoverable funds and apologised.
Such happy endings make headlines precisely because they are rare. In most hacks – like the Ronin and Bybit hacks – the money is never seen again.
Warning signs you could have seen#
- One protocol holding huge sums across many chains. Cross-chain bridges have been the most common target of large thefts. More chains mean more code and more ways in.
- A few trusted signers. If a small list of keepers can approve any withdrawal, whoever takes over that list takes over everything.
- Fast growth, little scrutiny. In 2021 money poured into new DeFi protocols faster than auditors could review them.
Do not count on getting stolen crypto back
Poly Network and Euler are exceptions. Most stolen crypto is laundered and never returned, and there is no bank or insurer obliged to refund you. Keep only what you need in bridges and DeFi protocols, prefer official and well-tested routes, and treat anyone who promises to "recover" your stolen coins for an upfront fee as the next scam.
Common myths#
- "Blockchain transparency means thieves always get caught." It makes cashing out harder, but many hackers launder the coins successfully. Transparency helped here; it does not guarantee anything.
- "If the hacker gives the money back, it was not a crime." Taking money without permission is still theft. Poly Network chose not to press charges – that was their decision, not the law's.
- "Returned hacks mean DeFi is safe." The opposite: they show how one bug can put hundreds of millions at risk in minutes.
Summary
- On 10 August 2021 a hacker took over 610 million USD from the cross-chain protocol Poly Network.
- The bug let the attacker replace the keepers who approve withdrawals with their own key.
- Public blockchains, freezes and traces made cashing out hard; the hacker returned practically everything within two weeks.
- Euler Finance (2023) is another rare refund – but most stolen crypto is never returned.
- Limit what you keep in bridges and DeFi, and never pay "recovery" services upfront.
Sources#
- SlowMist: The root cause of Poly Network being hacked (opens in a new tab)
- CNBC: Hacker behind the 600 million dollar Poly Network heist says they did it "for fun" (2021) (opens in a new tab)
- CoinDesk: Poly Network hacker releases private key for the remaining 141 million dollars (2021) (opens in a new tab)
- Chainalysis: Euler Finance flash loan attack explained (opens in a new tab)