Ethereum

Million

Read

<p class="is-style-lead">PolyNetwork is still trying to recover from the attack on July 2, where hackers stole about $5.5 million, even though the notional value of the episode is <a href="https://twitter.com/BeosinAlert/status/1675335846000578561" data-type="URL" data-id="https://twitter.com/BeosinAlert/status/1675335846000578561" target="_blank" rel="noopener">reportedly</a> $34 billion. The Poly developers have halted all smart contracts to resolve the breach.</p> 
<p>Following the incident, several blockchain security firms, including SlowMist, Binance Labs, Dedaub, and Peckshield, offered to assist with investigations.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Dear users,<br><br>As we continue to address this situation, we regret to inform you that our services will remain temporarily suspended. <br>【1/7】</p>— Poly Network (@PolyNetwork2) <a href="https://twitter.com/PolyNetwork2/status/1675591279005106178?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">July 2, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Dedaub published a<a href="https://dedaub.com/blog/poly-chain-hack-postmortem#" target="_blank" rel="noreferrer noopener"> technical assessment</a> of the hack a few hours after that shows PolyNetwork secured its wallets with a simple three-of-four multisig arrangement over two years – which is incredibly risky.</p> 
<p>In blockchain, the importance of<a href="https://crypto.news/enhancing-blockchain-security-combining-intel-sgx-and-zk-snarks/" target="_blank" rel="noreferrer noopener"> boosting wallet security</a> every few months cannot be over-emphasized. Dedaub found that the private keys to the multisig address were compromised.</p> 
<p>In addition to that, PolyNetwork took seven hours to halt the smart contracts. This is a long time in blockchain, considering the massive damage hackers can do in only a few minutes.&nbsp;</p> 
<h2 class="wp-block-heading" id="polynetwork-hack-affected-50-assets-on-10-blockchains">PolyNetwork hack affected 50+ assets on 10 blockchains</h2> 
<p>Despite executing a hack that affected over 50 assets in 10 different blockchains, Dedaub maintains the hack wasn’t complex. The hacker used the compromised private keys to sign confirmations that they owned the protocol’s BNB. Out of the ten blockchains affected, Metis, BSC, Heco, and Ethereum suffered the most harm.</p> 
<p>The attacker went ahead to<a href="https://docs.google.com/spreadsheets/d/1NK1v-hvaPKQviZqowtwwOm3swF0vNNN_vhFivbmRTqs/edit#gid=1847296343" target="_blank" rel="noreferrer noopener"> mint assets</a> on different blockchains and sold them. However, the attacker could not cash out all the stolen assets due to no liquidity for some assets on specific blockchains.</p> 
<p> You might also like: <a href="https://crypto.news/polynetwork-allegedly-hacked-massive-transactions-detected/"> PolyNetwork allegedly hacked, massive transactions detected </a> </p> 
<h2 class="wp-block-heading" id="polynetwork-cross-chain-managers-were-signed">PolyNetwork cross-chain managers were signed</h2> 
<p>As Dedaub continues to dig further into the execution of this hack, it believes the private keys were not stolen, implying the hack may have been an inside job. Dedaub arrived at this conclusion due to the lack of a logical bug in the exploitation.</p> 
<p>Examining the PolyNetwork Merkle tree, Dedaub found the entire header; consequently, the state root was signed. Furthermore, the code was correctly invoked by 3 of the designated private key keepers.</p> 
<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio">
 <div class="wp-block-embed__wrapper"> <iframe title="Multisignature Wallets Explained | Animation | Cryptomatics" width="1020" height="574" src="https://www.youtube.com/embed/E47Ih7DArKs?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe> 
 </div>
</figure> 
<p>A few hours before the Dedaub post-mortem came out with a contradicting conclusion, Arhat, founder of 3z3 Labs, posted his <a href="https://twitter.com/0xArhat/status/1675483634935922688" target="_blank" rel="noreferrer noopener">analysis</a> of the PolyNetwork hack. From his assessment, the hack happened because of a smart contract vulnerability.</p> 
<p>As more investigation into the event happens, more light may be shed on how this hack took place and the extent of its damage.</p> 
<p> Read more: <a href="https://crypto.news/poly-network-multi-chain-defi-protocol-611-million/"> Poly Network Multi-Chain DeFi Protocol Suffers $611 Million Heist </a> </p>

PolyNetwork remains suspended 24 hours after $5m hack

Table of Contents

crypto.news

Other articles published on Jul 3, 2023

AzukiDAO's Proposal to Hire a Lawyer to Reclaim 20,000 $ETH from Zagabond Passed

Wemade migrated WEMIX PLAY to its mainnet and enhanced usability

Pro-Ripple Lawyer Says SEC Created Uncertainty With DASH, XRP Security Status

BlackRock Makes Second Attempt at Spot Bitcoin ETF, Teams Up with CoinBase as SSA Partner

Missed Early Pepe’s Astonishing Performance, Buy DigiToads Now As It’s Expected To Follow The Sam...

XRP Price Continues to Consolidate Below $0.49: Here’s the Timeline for When XRP Might Break Above

Join our free newsletter for daily crypto updates!