Crypto platform Poly Network suspends service after hacker steals millions of dollars in digital assets

Millions of dollars worth of cryptocurrency were stolen from the Poly Network platform this weekend in an attack that saw hackers take billions of largely worthless coins.

The China-based decentralized finance (DeFi) platform provides users the ability to trade cryptocurrency assets across different blockchains.

Early on Sunday morning, the company said it was suspending its services due to the attack, explaining that it was working with its partners to assess what was stolen and calling on blockchain security firms to help them respond.

Dear users, we would like to inform you that Poly Network is temporarily suspending its services due to a recent attack. We are actively engaging with relevant parties and diligently assessing the extent of the affected assets. 【1/3】

— Poly Network (@PolyNetwork2) July 2, 2023

By Sunday afternoon, the company said 57 assets were affected on 10 blockchains, sharing a Google spreadsheet showing how much cryptocurrency was stolen during the cyberattack. The blockchains affected include Ethereum, Binance’s BNB Chain, Metis, Polygon and more.

“We have already initiated communication with centralized exchanges and law enforcement agencies to sought [sic] their assistance. We hope that the attacker will cooperate and return the user assets to avoid any potential legal consequences,” the company said on Twitter.

“To minimize further risks, we have reached out to the majority of project teams and urged them to promptly withdraw liquidity from decentralized exchanges. We also strongly advise users who hold the affected assets to expedite the process of withdrawing liquidity and unlocking their LP tokens.”

The hackers were able to use Poly Network to essentially give themselves an endless number of tokens.

The true value of the stolen funds was the source of debate among security companies examining the incident because the hackers minted billions of dollars worth of cryptocurrency on platforms that did not have the liquidity to actually allow them to cash out what they took.

Blockchain security firm PeckShield said $42 billion worth of cryptocurrency was minted while another company said $34 billion was minted – both of which were not reflective of what the hackers would actually be able to walk away with.

Several blockchain security companies told Recorded Future News that the hackers stole anywhere between $10.1 million and $20 million. Security firm Beosin said a total of 5,196 ETH was stolen, giving the hackers around $10 million.

“The stolen cryptos on Ethereum are worth about $20 million (including $ETH and other cryptos). Specifically, the exploiter has grabbed about 1,592.51 $ETH ($3 million) from the Poly Network and has also swapped part of other cryptos for 674 $ETH,” PeckShield told Recorded Future News.

“Currently, the exploiter holds 2,266.15 $ETH ($4.3 million). Other cryptos may need to be valued based on their liquidity and price volatility.”

Experts at Beosin and another firm, MetaSleuth, said about $260 million worth of Binance’s cryptocurrency was also stolen but it likely would not be cashed out by the attacker due to low liquidity on the platform they were taken from.

Binance CEO Changpeng Zhao said the incident “does not affect Binance users.”

“We do not support deposits from this network. Our security team is assisting them in its investigations though,” he said on Twitter.

Several other crypto platforms with ties to Poly Network announced that they were pausing any connections.

“We are aware of Polybridge’s ongoing situation, and are currently in contact with the PolyNetwork team to minimize the impact of the attack and further asses the situation. In regards to the newly minted BNB and BUSD on Metis, there is no sell liquidity available,” crypto platform Metis said.

”All minted METIS tokens from PolyBridge have been locked on BNBChain by PolyNetwork and have limited liquidity.”

This is not the first headline-grabbing attack on Poly Network — in 2021, a hacker stole more than $600 million worth of cryptocurrency from the company before eventually returning a significant portion of the funds in exchange for a financial reward.