Anatomy of a $611M Cross-Chain Exploit — and Its Unlikely Reversal
An attacker drained approximately $611 million from Poly Network's cross-chain infrastructure, making it the largest cryptocurrency theft on record at the time — surpassing even the Mt. Gox collapse. Poly Network confirmed the exploit shortly after it occurred.
Attacker's Ethereum address: 0xc8a65fadf0e0ddaf421f28feab69bf6e2e589963
Attacker's BSC address: 0x0D6e286A7cfD25E0c01fEe9756765D8033B32C71
01Not a flash loan — a contract-level takeover
Unlike the arbitrage-style flash loan attacks common at the time, this exploit targeted the Proxy Lock Contracts that Poly Network operates across three chains:
Ethereum: 0x250e76987d838a75310c34bf422ea9f1ac4cc906
BSC: 0x05f0fDD0E49A5225011fff92aD85cC68e1D1F08e
Polygon: 0x28FF66a1B95d7CAcf8eDED2e658f768F44841212
As explained by @kelvinfichter, the vulnerability sat inside a contract called EthCrossChainManager — a privileged component with the authority to trigger actions based on messages from other chains, a common pattern in cross-chain systems.
That contract exposes a function, verifyHeaderAndExecuteTx, callable by anyone, which executes a cross-chain transaction. It first verifies that a block header is valid by checking signatures (the counterpart chain functioned as a PoA sidechain), then confirms via a Merkle proof that the transaction was actually included in that block. The relevant code is here.
Toward the end of its execution, the function calls executeCrossChainTx, which in turn calls the target contract specified in the message — and this is where the flaw lived. Poly's code checks only that the target is a contract, without excluding one particularly sensitive target: the EthCrossChainData contract.
By submitting a crafted cross-chain message, the attacker could get EthCrossChainManager — which passes the onlyOwner check on EthCrossChainData — to call into that data contract on their behalf. From there, the remaining task was constructing input that would trigger the function responsible for updating the contract's stored public keys.
The final piece involved how Solidity resolves which function is being called. The first four bytes of a transaction's input data — the "sighash" — identify the target function, and are derived by hashing the function's name and parameter types (e.g., the ERC20 transfer sighash comes from hashing "transfer(address,uint256)"). Poly's contract would call any function whose sighash matched a specific expected value. Critically, part of the input used to compute that expected value — labeled _method — was itself attacker-controlled. That meant the attacker only needed to find some string that, when hashed as part of a function signature, produced the same four-byte prefix as the real target function — not a full hash collision, just a four-byte match, which is computationally easy to grind for.
The legitimate target function's sighash:
ethers.utils.id('putCurEpochConPubKeyBytes(bytes)').slice(0, 10)→0x41973cd9
The attacker's crafted function signature produced the same result:
ethers.utils.id('f1121318093(bytes,bytes,uint64)').slice(0, 10)→0x41973cd9
No private key was ever compromised. The attacker simply supplied data that made the contract call itself in a way its own owner-check couldn't distinguish from a legitimate call.
The broader lesson, per kelvinfichter: cross-chain relay contracts must never be permitted to call other privileged, special-purpose contracts. EthCrossChainManager should not have had ownership rights over EthCrossChainData — the two roles needed to be separated, with no path for cross-chain messages to reach sensitive contracts directly.
02What was taken
On Ethereum: USDC — 96,389,444 WBTC — 1,032 DAI — 673,227 UNI — 43,023 SHIBA — 259,737,345,149 renBTC — 14.47 USDT — 33,431,197 wETH — 26,109 FEI USD — 616,082
On BSC: BNB — 6,613.44 USDC — 87,603,373 ETH — 299 BTCB — 26,629 BUSD — 1,023
On Polygon: USDC — 85,089,610
Total value lost: approximately $611,000,000
At the time of reporting, the stolen assets sat in these addresses:
ETH: 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589963
BSC: 0x0D6e286A7cfD25E0c01fEe9756765D8033B32C71
Polygon: 0x5dc3603C9D42Ff184153a8a9094a73d461663214
03A strange cast of characters
Soon after the exploit, an account called hanashiro.eth sent the attacker a message offering advice on handling the stolen USDT, and was rewarded with 13.37 ETH directly from the attacker's wallet. Numerous other accounts attempted similar outreach, but none matched hanashiro.eth's result. hanashiro.eth subsequently donated the reward to infrastructure and media organizations serving the crypto industry, including Infura, Etherscan, and rekt.news.
Not all of the proceeds were so easy to move. Tether froze the full 33 million USDT taken on Ethereum — a reminder that centralized stablecoin issuers retain unilateral freeze authority over their tokens.
As pressure mounted, Poly Network published an open letter addressed directly to the attacker, asking for the funds to be returned — an unusual public appeal that drew comparisons to SEC Chair Gary Gensler's characterization of crypto as still operating in a "Wild West" phase.
The attacker's own on-chain activity offered a window into their state of mind. In one self-sent transaction, they included the note: "Wonder why Tornado? Will miners stop me? Teach me please" — apparently weighing Tornado Cash as a laundering route.
A possible turning point came when @WardBradt noted that one of the attacker's transactions had used a sender address linked to KYC'd accounts on FTX, Binance, and OKEx — potentially an operational security mistake, though it remained unclear whether it was accidental or based on fabricated identity documents. Following that observation, the attacker's tone shifted noticeably.
The attacker then floated the idea of returning "some tokens," said they were "not so interested in the money," and at one point considered forming a DAO to redistribute the stolen assets. Eventually, the attacker declared readiness to give everything back, sending a transaction announcing "READY TO SURRENDER", followed by one titled "READY TO RETURN THE FUNDS!" — sent from the same wallet used in the original attack.
Before initiating the first return transaction, the attacker minted a token literally named "The hacker is ready to surrender" and sent it to Poly Network. The project responded by setting up a multisig controlled by known Poly Network addresses to receive the returned assets. A full log of the back-and-forth communication with the attacker is available here.
As of the time of writing, returned funds included:
04Context
At $611 million, this exploit exceeded not just any single prior hack but the combined total of every incident previously tracked. Even so, broader markets showed little reaction — a sign, perhaps, of how the industry has scaled. That same week brought contrasting headlines, from Coinbase's stronger-than-expected Q2 results to BitMEX's $100 million settlement with the CFTC and FinCEN, underscoring that the industry's growing pains are now playing out on a much larger stage than before.
Credit: breadcrumbs.app, SlowMist, BlockSec
Get new scam files the moment we publish them — usually 2–3 emails a week.