Polygon Bridge Users Forgot to Reclaim $27M

Polygon Bridge Users Forgot to Reclaim $27M

3 months ago

The two-step process for shifting funds from Polygon back to Ethereum has caused thousands of the blockchain's users to accidentally leave funds behind according to a report.

Polygon Bridge Users Forgot to Reclaim $27M


Listen to the CoinMarketRecap podcast on Apple Podcasts, Spotify and Google Podcasts

It must be nice to be able to forget to complete the second half of a simple, two-step transaction to reclaim $2 million and not notice it.

But that's apparently what happened to at least one user of the Polygon Bridge, which allows users of the Polygon blockchain to make cross-chain payments to and from Ethereum.

While preparing to add support for Polygon and its MATIC token, the ZenGo non-custodial wallet's development team found that one anonymous user — who it nicknamed 0x007 — had begun a pair of transactions to trade about $1 million each of Wrapped BTC and Wrapped ETH back in May but had not completed them.

While 0x007 may have been far and away the biggest of the fund forgetters, they were hardly the only one, said Tal Be'ery co-founder and CTO of ZenGo, in a Nov. 28 blog post. In all, some $27 million in Ether and the USDT, USDC and DAI stablecoins had been lost in mid-transaction.

If that sounds like a lot of careless crypto users, keep it in perspective: For one thing, there's about $7 billion locked in the bridge.

For another, it's not unique to crypto. New York State alone is holding onto $17.5 billion in lost or abandoned funds, and only managed to return $358 million this year. Every state has an unclaimed funds website, and none are nearly as large as the federal government's list of lost bounty.

One, Two Many

The problem, ZenGo reasoned, was probably based on the nature of how Polygon Bridge works, Be'ery said. To send an Ethereum-based token to Polygon, one simply deposits assets with the bridge and Polygon tokens appear in their wallet.

But, in the other direction, the user has to send their Polygon tokens to a burn address, wait an hour or so, and then send a second Ethereum transaction to reclaim their funds, the company said. The problem is:

"The deposit side (Ethereum → Polygon) is a one click process that takes a few minutes. However, the withdrawal side (Polygon → Ethereum) is a two step process, and may take a few hours between the first step and the availability of the final step."

Which suggests that either users don't realize they need to take that second step or — and this seems less likely — they just forget about it.

ZenGo used a Dune Analytics tool to search for unmatched withdrawal/claim pairs, and found about 3,000. Which can be found on this page, updated regularly, Be'ery said.

As for 0x007, ZenGo saw that wallet had been active on Ethereum in June, so the problem didn't seem to be a lost private key, so they contacted Polygon, which completed the transaction for them.

The gray cloud of this silver lining? The tokens 0x007 had forgotten on Polygon Bridge were worth more than $3 million at the time the transaction began.

1 person liked this article