- PolyNetwork attackers manipulated the bridge into issuing fake tokens
- They exchanged the liquid ones for 403 ETH
Hackers issued $42 billion worth of malicious tokens on PolyNetwork on Sunday morning after a smart contract exploit, CoinDesk reported. They exploited a function in the protocol’s bridge tool, which enables users to transfer tokens between blockchains by means of locking value on one blockchain and releasing it on another.
They issued nonexistent tokens
PolyNetwork attackers manipulated the bridge into issuing tokens on a blockchain which did not exist. They minted 999 trillion Shiba Inu (SHIB) on the Heco blockchain, 24 billion Binance USD and BNB on the Metis blockchain, and millions more on other blockchains, including Polygon and Avalanche. Right after the attack, the exploiters’ wallet held more than $42 billion worth of tokens.
However, these tokens were only on paper. They were totally illiquid, which stopped the attackers from monetizing their huge volume. Metis blockchain developers confirmed the BUSD and BNB couldn’t be sold due to lack of liquidity. Developers locked the illicitly issued METIS tokens on the PolyNetwork bridge.
Attackers still made away with ETH worth $792M
The attackers were able to exchange some tokens for a total of 403 ETH, equivalent to $792 million at current exchange rates. According to analytics company Lookonchain, cited by CoinDesk, they exchanged 94 billion SHIB tokens for 360 ether (ETH), 15 million RFuel for 27 ETH, and 495 million COOK for 16 ETH. The company added that the hackers were transferring ETH and other assets to new wallets, probably to sell them.
PolyNetwork was hacked for $600M in 2021
This is not the first attack on PolyNetwork. It suffered a then-record hack for $600 millionin August 2021. Allegedly, a private key that was used to sign a cross-chainmessage was leaked.
Hacks continue to plague the crypto industry, with exploited crypto accounts selling for thousands on the Dark Web according to law enforcement agencies.
