Earlier this month, a hacker swiped over $600 million in cryptocurrency by exploiting a vulnerability in Poly Network, a platform that enables transactions between different blockchains. Just a few days later, however, the thief returned more than half of the funds—a little over $342 million. They were effectively forced to make the move after Poly Network posted the addresses of their digital wallets, flagging any transactions as illegal—the digital equivalent of dye packs stuffed inside bundles of cash.
The even weirder thing, though, is that Poly Network actually began working with the hacker, who went by the alias Mr. White Hat, and eventually ended up offering him a job as chief security advisor. It also ponied up a bug bounty of $500,000 for discovering the exploit that enabled the theft, even though he still hadn’t given back the full amount of cryptocurrency he’d taken.
Now he has. In a blog post, Poly Network said Mr. White Hat shared his key to a multi-signature wallet with the company on August 23, enabling it to reclaim 28,953 ETH (Etherium) and 1,032 WBTC (Wrapped Bitcoin) worth roughly $141 million in total.
“At this point, all the user assets that were transferred out during the incident have been fully recovered,” Poly Network wrote. “Thanks to Mr. White Hat’s cooperation, Poly Network has officially entered the fourth phase of our roadmap ‘Asset Recovery’. We are in the process of returning full asset control to users as swiftly as possible.”
“As of now, Poly Network has regained control of the $610 million (not including the frozen $33 million USDT) in assets that were overall affected in this attack. Once again, we would like to thank Mr. White Hat for keeping his promise, as well as the community, partners and the multiple security agencies for their assistance.”
According to a CNBC report, a message embedded in a transaction that was purportedly from the hacker claimed that he is “[quitting] the game”—presumably a reference to the life of digital crime—and even apologized, literally, for the inconvenience.
“My actions, which may be considered weird, are my efforts to contribute to the security of the Poly project in my personal style,” the message said. “The consensus was reached in a painful and obscure way, but it works. Some people even suspect that the whole story is a PR stunt.”
Based on that, it sounds like Mr. White Hat isn’t going to take Poly Network up on its job offer. I’ve reached out to the company to ask about the current status of their relationship with the hacker, and will update if I receive a reply.
