Poly Network says it's got pretty much all of that $610m in stolen crypto-coins back
(2021/08/24)
- Reference: 1629758231
- News link: https://www.theregister.co.uk/2021/08/23/poly_network_payback/
- Source link:
Poly Network says virtually all of the crypto-currency funds, valued at $610m, stolen from it by a thief have been returned.
The mysterious crook siphoned off the dosh earlier this month by exploiting a vulnerability in the Chinese exchange's smart contracts that handle the movement of tokens between blockchains.
The thief, dubbed Mr White Hat by Poly Network, promised to hand the funds back, claiming it was just done for fun and to highlight the security flaw. A portion was given back earlier this month, and the rest has been returned, apparently. The coins will be funneled back to their rightful owners – Poly Network's users stiffed in the record-breaking cyber-heist.
[1]
Specifically, some of the remaining funds were held in a wallet that could only be unlocked with the binary bandit's help; the private key needed to access those funds was given up to Poly some hours ago.
[2]
[3]
"Poly Network has successfully retrieved the remaining 28,953 ETH and 1,032 WBTC (about $141m)," the outfit [4]said today.
"At this point, all the user assets that were transferred out during the incident have been fully recovered. Thanks to Mr White Hat’s cooperation, Poly Network has officially entered the fourth phase of our roadmap: asset recovery. We are in the process of returning full asset control to users as swiftly as possible."
[5]
According to messages embedded in transaction metadata by the thief, the miscreant has also returned the $500,000 bounty Poly paid for more details about the robbery as well as donations the crook received.
"Keep calm and this is the happy ending," the rogue [6]wrote . "I have to admit that my wild or mad behaviours have led crises to your project, your team or even your lives. Sorry for the inconvenience.
"I'm quitting the show. Believe it or not I never considered the shared wallet as the 'hostage' for ransom. As you may have noticed I have poured your bounty and my compensation fund from donations into the shared multisig wallet. Not sure it's convenient, but distributing the extra assets to the 'survivors' would be the last request from this man."
[7]OK, so you stole $600m-plus from us, how about you be our Chief Security Advisor, Poly Network asks thief
[8]I was offered $500k as a thank-you bounty for pilfering $600m from Poly Network, says crypto-thief
[9]Thief hands back at least a third of $600m in crypto-coins stolen from Poly Network
[10]$600m in cryptocurrencies swiped from Poly Network
The only outstanding funds are $33m [11]frozen by Tether soon after the digital larceny became apparent. Efforts are underway to unfreeze the digicash and return it to its owners.
So what next for the mystery miscreant? Well, even though the money has been returned, a crime was committed and the police may be keen to unmask the person as well as businesses. Blockchain security outfit Slowmist boasted earlier it had discovered "the attacker’s mailbox, IP, and device fingerprints through on-chain and off-chain tracking," and others may be on the thief's tail.
[12]
"I think that what happens next is largely up to law enforcement," Tom Robinson, chief scientist at blockchain analysis house Elliptic, told The Register .
"There are certainly plenty of blockchain clues to start from, if they decide to pursue the person involved. Building secure decentralized applications is very challenging, and this person could be a very valuable resource. I'm sure many people would be keen to employ them, in the right circumstances." ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://medium.com/poly-network/poly-network-commences-full-asset-restoration-7f5c548423b9
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://twitter.com/tomrobin/status/1429764560064552964/photo/1
[7] https://www.theregister.com/2021/08/18/poly_network_job/
[8] https://www.theregister.com/2021/08/14/poly_network_payment/
[9] https://www.theregister.com/2021/08/11/poly_network_funds_returned/
[10] https://www.theregister.com/2021/08/10/poly_networks_cryptocurrency_theft/
[11] https://twitter.com/paoloardoino/status/1425090760609832978
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
The mysterious crook siphoned off the dosh earlier this month by exploiting a vulnerability in the Chinese exchange's smart contracts that handle the movement of tokens between blockchains.
The thief, dubbed Mr White Hat by Poly Network, promised to hand the funds back, claiming it was just done for fun and to highlight the security flaw. A portion was given back earlier this month, and the rest has been returned, apparently. The coins will be funneled back to their rightful owners – Poly Network's users stiffed in the record-breaking cyber-heist.
[1]
Specifically, some of the remaining funds were held in a wallet that could only be unlocked with the binary bandit's help; the private key needed to access those funds was given up to Poly some hours ago.
[2]
[3]
"Poly Network has successfully retrieved the remaining 28,953 ETH and 1,032 WBTC (about $141m)," the outfit [4]said today.
"At this point, all the user assets that were transferred out during the incident have been fully recovered. Thanks to Mr White Hat’s cooperation, Poly Network has officially entered the fourth phase of our roadmap: asset recovery. We are in the process of returning full asset control to users as swiftly as possible."
[5]
According to messages embedded in transaction metadata by the thief, the miscreant has also returned the $500,000 bounty Poly paid for more details about the robbery as well as donations the crook received.
"Keep calm and this is the happy ending," the rogue [6]wrote . "I have to admit that my wild or mad behaviours have led crises to your project, your team or even your lives. Sorry for the inconvenience.
"I'm quitting the show. Believe it or not I never considered the shared wallet as the 'hostage' for ransom. As you may have noticed I have poured your bounty and my compensation fund from donations into the shared multisig wallet. Not sure it's convenient, but distributing the extra assets to the 'survivors' would be the last request from this man."
[7]OK, so you stole $600m-plus from us, how about you be our Chief Security Advisor, Poly Network asks thief
[8]I was offered $500k as a thank-you bounty for pilfering $600m from Poly Network, says crypto-thief
[9]Thief hands back at least a third of $600m in crypto-coins stolen from Poly Network
[10]$600m in cryptocurrencies swiped from Poly Network
The only outstanding funds are $33m [11]frozen by Tether soon after the digital larceny became apparent. Efforts are underway to unfreeze the digicash and return it to its owners.
So what next for the mystery miscreant? Well, even though the money has been returned, a crime was committed and the police may be keen to unmask the person as well as businesses. Blockchain security outfit Slowmist boasted earlier it had discovered "the attacker’s mailbox, IP, and device fingerprints through on-chain and off-chain tracking," and others may be on the thief's tail.
[12]
"I think that what happens next is largely up to law enforcement," Tom Robinson, chief scientist at blockchain analysis house Elliptic, told The Register .
"There are certainly plenty of blockchain clues to start from, if they decide to pursue the person involved. Building secure decentralized applications is very challenging, and this person could be a very valuable resource. I'm sure many people would be keen to employ them, in the right circumstances." ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://medium.com/poly-network/poly-network-commences-full-asset-restoration-7f5c548423b9
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://twitter.com/tomrobin/status/1429764560064552964/photo/1
[7] https://www.theregister.com/2021/08/18/poly_network_job/
[8] https://www.theregister.com/2021/08/14/poly_network_payment/
[9] https://www.theregister.com/2021/08/11/poly_network_funds_returned/
[10] https://www.theregister.com/2021/08/10/poly_networks_cryptocurrency_theft/
[11] https://twitter.com/paoloardoino/status/1425090760609832978
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSRu9pCeJW0mXzoPBVEFMQAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
What next indeed
Anonymous Coward
The mysterious crook siphoned off the dosh earlier this month by exploiting a vulnerability in the Chinese exchange's smart contracts that handle the movement of tokens between blockchains.
and
So what next for the mystery miscreant?
A nervous wait to see if the Chinese authorities renege on their promise not to send an assassination squad round to punish him for making them look incompetent in return for giving the money back?
Re: What next indeed
Mark 85
Quite possible they hired him to work for them under the condition he returned the money also. Just a bit of duress goes a long way.
Well, butter me sideways
Anonymous Coward
Who would have thought that imaginary “money” could just disappear like that?
Frozen by Tether
Anonymous Coward
And there you are.
Traceable.
Trivial to remotely freeze.
Your fake transaction currency couldn't even be used to pay OnlyFans crotch fiddlers.
Add the core problems:
It collapses as soon as more people want out than in,
It is constantly being inflated by miners,
Every transaction is recorded for posterity forever,
If ever it became a real transaction medium, the blockchain size would be too big for users to hold, but you can guarantee that the FBI holds a *full* copy. So even the blockchain part is utterly useless.
If you use it, you're likely to be exit scammed, because the players pushing it know the false nature of the product they push. They are already deep into the scam, so what's a little deeper?!
"Believe it or not"
I don't believe it, you fucking asshole.
An actual White Hat would never have taken the money.
You are a failed criminal, which just might be the highest honor you can pretend to.