{"investigation":{"slug":"polynetwork","entity_name":"PolyNetwork","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":0.92,"status":"published","content_type":"investigation","summary":"Poly Network was a cross-chain interoperability protocol launched in August 2020 by Neo, Ontology, and Switcheo. It suffered two major security breaches: a $610 million exploit in August 2021 (the largest DeFi hack at the time, with funds ultimately returned) and a second exploit in July 2023 in which attackers minted billions in notional value of tokens, extracting an estimated $10–20 million in real assets. The protocol permanently terminated all services on September 30, 2024.","sections":[{"content":"Poly Network is a heterogeneous cross-chain interoperability protocol launched on August 18, 2020. Its founding members were three major blockchain projects: Neo, Ontology, and Switcheo. The protocol was designed to facilitate cross-chain asset transfers without issuing a native token and without requiring protocol overhead for integration. It supported major chains including Ethereum, Binance Smart Chain, Polygon, Neo, Ontology, Bitcoin, and others. The platform operated using a relay-chain architecture consisting of three layers: smart contracts on participating chains, relayers to transmit cross-chain messages, and a coordinating Poly Chain. The protocol was designed to be tokenless and positioned itself as infrastructure for the emerging multichain ecosystem.","heading":"Overview and Background","sources":[{"url":"https://neo.org/blog/details/4207","name":"neo.org","type":"other","credibility":3},{"url":"https://neonewstoday.com/general/neo-collaborates-with-switcheo-and-ontology-to-launch-poly-network-a-new-tokenless-and-heterogeneous-interoperability-protocol/","name":"neonewstoday.com","type":"other","credibility":3},{"url":"https://phemex.com/academy/what-is-poly-network","name":"phemex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 10, 2021, an anonymous attacker exploited a critical access control vulnerability in Poly Network's smart contracts, transferring approximately $610 million in digital assets across three chains: $273 million in ETH on Ethereum, $253 million in BEP-20 tokens on Binance Smart Chain, and $85 million in USDC on Polygon. This represented the largest DeFi hack in history at the time of the incident. The vulnerability involved a mismanagement of permissions between two high-privilege smart contracts: EthCrossChainManager and EthCrossChainData. EthCrossChainManager held owner-level access over EthCrossChainData, allowing it to call privileged functions. The attacker exploited the verifyHeaderAndExecuteTx function to pass the string 'f1121318093' as a method parameter, which triggered EthCrossChainData to register the attacker's public key as a Keeper address. Once granted Keeper status, the attacker drained funds from Poly Network's liquidity wallets across multiple blockchains. Security firm SlowMist conducted an independent analysis corroborating this root cause. The attacker's identity was never confirmed. On August 11, 2021, the attacker began returning funds, claiming the theft was a demonstration of the vulnerability rather than a theft with malicious intent. Poly Network addressed the hacker as 'Mr. White Hat,' offered a $500,000 bug bounty, and proposed a 'chief security advisor' role. The hacker declined the bounty and completed the return of all funds by August 25, 2021. Security experts criticized the 'white hat' designation, arguing it risked normalizing large-scale theft under the guise of vulnerability research.","heading":"2021 Exploit — $610 Million Theft (Critical)","sources":[{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://research.kudelskisecurity.com/2021/08/12/the-poly-network-hack-explained/","name":"research.kudelskisecurity.com","type":"other","credibility":3},{"url":"https://halborn.com/explained-the-poly-network-hack-august-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/the-root-cause-of-poly-network-being-hacked-ec2ee1b0c68f","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/the-analysis-and-q-a-of-poly-network-being-hacked-8112a35beb39","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/poly-network-hack-august-2021/","name":"chainalysis.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/the-poly-network-hack-600-million-in-crypto-stolen-and-returned-in-24-hours","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.cnbc.com/2021/08/23/poly-network-hacker-returns-remaining-cryptocurrency.html","name":"cnbc.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/poly-network-hacker-returns-nearly-all-funds-refuses-500k-white-hat-bounty","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 2, 2023, Poly Network suffered a second major security breach. Attackers exploited compromised private keys belonging to Poly Network's Relay Chain consensus nodes (keepers). Security researchers at Dedaub determined the most likely root cause was the compromise of at least 3 of the 4 consensus node private keys, potentially via a Trojan virus embedded in the compilation environment, though the team noted the attack was also consistent with a rug pull scenario. With control over the keeper keys, the attackers forged cross-chain transactions that allowed them to mint arbitrary quantities of tokens across 11 blockchains, affecting 58 distinct assets. Initial reports described the notional value of minted assets at $34–43 billion; however, nearly all of these tokens lacked sufficient on-chain liquidity to be sold at stated prices. Security firms estimated the actual realized losses at between $10.1 million and $20 million, with approximately 5,196 ETH (roughly $10 million) extracted on Ethereum alone. Poly Network suspended services immediately and stated it was coordinating with centralized exchanges and law enforcement. The attacker's identity was not publicly confirmed. The protocol did not resume full operations following this incident.","heading":"2023 Exploit — Private Key Compromise and Minting Attack (Critical)","sources":[{"url":"https://therecord.media/crypto-platform-poly-network-suspends-service-after-hack","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-poly-network-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://dedaub.com/blog/poly-network-hack/","name":"dedaub.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/07/02/polynetwork-attacker-issues-worthless-billions-in-shib-bnb-busd-in-latest-crypto-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/poly-network-exploit-hackers/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://polynetwork.medium.com/the-poly-network-exploit-analysis-b0a77aff6078","name":"polynetwork.medium.com","type":"other","credibility":3},{"url":"https://crypto.news/polynetwork-remains-suspended-24-hours-after-5m-hack/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/poly-network-hack","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 11, 2024, Poly Network published a notice announcing the complete termination of all services effective September 30, 2024. The announcement cited 'changing market landscape' as the reason for closure and included no detail on data migration, outstanding user asset handling, or transition procedures. The notice provided only 19 days of advance warning. Prior to the full shutdown announcement, the team had indicated in April 2024 that it would suspend new deployments and only support existing partners. As of the date of this investigation, all Poly Network services, including the Poly Bridge cross-chain bridge, are permanently offline.","heading":"Service Termination","sources":[{"url":"https://polynetwork.medium.com/notice-of-complete-termination-of-poly-network-services-3470ef78d9d9","name":"polynetwork.medium.com","type":"other","credibility":3},{"url":"https://neonewstoday.com/development/poly-network-announces-complete-termination-of-all-services/","name":"neonewstoday.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Poly Network's security history is characterized by two severe exploits within approximately two years of operation. The 2021 incident exposed a fundamental access control flaw — an architectural design error in which a high-privilege manager contract was permitted to call privileged functions on a data contract without adequate access restrictions. This type of error is considered a basic smart contract security failure. Following the 2021 incident, the protocol launched a bug bounty program on Immunefi with rewards up to $100,000 for critical vulnerabilities, yet the platform suffered a second critical breach in 2023. The 2023 exploit indicated persistent weaknesses in key management practices for the Relay Chain consensus nodes. Independent researchers noted that the keeper key architecture — requiring only 3 of 4 keys to be compromised to execute fraudulent cross-chain transactions — represented an insufficient security threshold for a protocol handling hundreds of millions in user assets. The combination of two high-severity exploits, inadequate remediation between incidents, and eventual complete shutdown constitutes a record of critical security failure.","heading":"Security Track Record and Risk Assessment","sources":[{"url":"https://halborn.com/explained-the-poly-network-hack-august-2021/","name":"halborn.com","type":"other","credibility":3},{"url":"https://research.kudelskisecurity.com/2021/08/12/the-poly-network-hack-explained/","name":"research.kudelskisecurity.com","type":"other","credibility":3},{"url":"https://dedaub.com/blog/poly-network-hack/","name":"dedaub.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-poly-network-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"No public enforcement actions by the SEC, CFTC, DOJ, or OFAC against Poly Network or its founding organizations (Neo, Ontology, Switcheo) have been identified in available records as of May 2026. Following the 2021 hack, Poly Network stated it had reported the incident to law enforcement; however, no arrests or prosecutions have been publicly reported in connection with either the 2021 or 2023 incidents. The identity of the 2021 attacker, referred to by the protocol as 'Mr. White Hat,' remains unconfirmed. The attacker embedded messages in Ethereum transactions during the 2021 incident claiming to be a security researcher, but these claims were never verified by an independent authority. The 2023 attacker's identity also remains unknown.","heading":"Regulatory and Law Enforcement Context","sources":[{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2021/12/07/most-influential-40-polynetwork-hacker","name":"coindesk.com","type":"other","credibility":3},{"url":"https://therecord.media/crypto-platform-poly-network-suspends-service-after-hack","name":"therecord.media","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain investigator ZachXBT has flagged Poly Network in connection with security concerns. The platform appeared on ZachXBT's tracked list of exploited or risky crypto entities following its repeated breaches. Community discussions on platforms including Reddit and Crypto Twitter (now X) widely criticized the protocol's security posture, its decision to offer the 2021 attacker a 'chief security advisor' role, and the lack of transparency surrounding the 2023 key compromise. These community-level flags carry Tier 3 credibility in isolation but are consistent with the documented on-chain evidence of the exploits.","heading":"ZachXBT and Community Flags","sources":[{"url":"https://decrypt.co/147059/poly-network-attack-conjures-billions-of-dollars-in-tokens-that-did-not-exist","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-08-18","event":"Poly Network launched by founding members Neo, Ontology, and Switcheo as a tokenless heterogeneous cross-chain interoperability protocol.","source":""},{"date":"2021-08-10","event":"Attacker exploits access control vulnerability in EthCrossChainManager and EthCrossChainData smart contracts, draining approximately $610 million across Ethereum, Binance Smart Chain, and Polygon — the largest DeFi hack at the time.","source":""},{"date":"2021-08-11","event":"Attacker begins returning stolen funds and claims via embedded on-chain messages that the theft was intended to expose the vulnerability. Poly Network refers to the attacker as 'Mr. White Hat.'","source":""},{"date":"2021-08-13","event":"Approximately $340 million in funds returned; remaining assets moved to a multi-signature address requiring Poly Network cooperation for transfer.","source":""},{"date":"2021-08-25","event":"Final tranche of stolen funds returned. Poly Network confirms all assets recovered. The hacker declines the $500,000 bug bounty.","source":""},{"date":"2021-09","event":"Poly Network launches a bug bounty program on Immunefi offering up to $100,000 for critical vulnerabilities.","source":"","date_original":"2021-09-01"},{"date":"2023-07-02","event":"Second major exploit: attackers allegedly compromise 3 of 4 Relay Chain keeper private keys via Trojan virus or insider action, minting billions in notional-value tokens across 11 chains. Actual realized losses estimated at $10–20 million. Services immediately suspended.","source":""},{"date":"2023-07-04","event":"Poly Network publishes post-mortem attributing the 2023 exploit to Trojan-implanted malware in the compilation environment used to generate consensus node keys.","source":""},{"date":"2024-04","event":"Poly Network announces it will cease new deployments and transition to support-only mode for existing partners.","source":"","date_original":"2024-04-01"},{"date":"2024-09-11","event":"Poly Network publishes notice of complete termination of all services effective September 30, 2024, citing 'changing market landscape.'","source":""},{"date":"2024-09-30","event":"All Poly Network services, including Poly Bridge, permanently shut down.","source":""}],"sources_used":[{"url":"https://neo.org/blog/details/4207","name":"neo.org","type":"other","archive_url":"http://web.archive.org/web/20260418011431/https://neo.org/blog/details/4207","credibility":3,"archive_timestamp":"2026-04-18T01:14:31+00:00"},{"url":"https://neonewstoday.com/general/neo-collaborates-with-switcheo-and-ontology-to-launch-poly-network-a-new-tokenless-and-heterogeneous-interoperability-protocol/","name":"neonewstoday.com","type":"other","archive_url":"http://web.archive.org/web/20260113193242/https://neonewstoday.com/general/neo-collaborates-with-switcheo-and-ontology-to-launch-poly-network-a-new-tokenless-and-heterogeneous-interoperability-protocol/","credibility":3,"archive_timestamp":"2026-01-13T19:32:42+00:00"},{"url":"https://phemex.com/academy/what-is-poly-network","name":"phemex.com","type":"other","archive_url":"https://web.archive.org/web/20260830080513/https://phemex.com/academy/what-is-poly-network","credibility":3,"archive_timestamp":"2026-08-30T08:05:13+00:00"},{"url":"https://en.wikipedia.org/wiki/Poly_Network_exploit","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260819195251/https://en.wikipedia.org/wiki/Poly_Network_Exploit","credibility":3,"archive_timestamp":"2026-08-19T19:52:51+00:00"},{"url":"https://research.kudelskisecurity.com/2021/08/12/the-poly-network-hack-explained/","name":"research.kudelskisecurity.com","type":"other","archive_url":"http://web.archive.org/web/20250729214805/https://research.kudelskisecurity.com/2021/08/12/the-poly-network-hack-explained/","credibility":3,"archive_timestamp":"2025-07-29T21:48:05+00:00"},{"url":"https://halborn.com/explained-the-poly-network-hack-august-2021/","name":"halborn.com","type":"other","archive_url":"https://web.archive.org/web/20260829134428/https://www.halborn.com/blog/post/explained-the-poly-network-hack-august-2021","credibility":3,"archive_timestamp":"2026-08-29T13:44:28+00:00"},{"url":"https://slowmist.medium.com/the-root-cause-of-poly-network-being-hacked-ec2ee1b0c68f","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20260422164553/https://slowmist.medium.com/the-root-cause-of-poly-network-being-hacked-ec2ee1b0c68f","credibility":3,"archive_timestamp":"2026-04-22T16:45:53+00:00"},{"url":"https://slowmist.medium.com/the-analysis-and-q-a-of-poly-network-being-hacked-8112a35beb39","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250909131155/https://slowmist.medium.com/the-analysis-and-q-a-of-poly-network-being-hacked-8112a35beb39","credibility":3,"archive_timestamp":"2025-09-09T13:11:55+00:00"},{"url":"https://www.chainalysis.com/blog/poly-network-hack-august-2021/","name":"chainalysis.com","type":"other","archive_url":"http://web.archive.org/web/20260315140752/https://www.chainalysis.com/blog/poly-network-hack-august-2021/","credibility":3,"archive_timestamp":"2026-03-15T14:07:52+00:00"},{"url":"https://www.elliptic.co/blog/the-poly-network-hack-600-million-in-crypto-stolen-and-returned-in-24-hours","name":"elliptic.co","type":"other","archive_url":"http://web.archive.org/web/20260316000635/https://www.elliptic.co/blog/the-poly-network-hack-600-million-in-crypto-stolen-and-returned-in-24-hours","credibility":3,"archive_timestamp":"2026-03-16T00:06:35+00:00"},{"url":"https://www.cnbc.com/2021/08/23/poly-network-hacker-returns-remaining-cryptocurrency.html","name":"cnbc.com","type":"other","archive_url":"http://web.archive.org/web/20260826080701/https://www.cnbc.com/2021/08/23/poly-network-hacker-returns-remaining-cryptocurrency.html","credibility":3,"archive_timestamp":"2026-08-26T08:07:01+00:00"},{"url":"https://cointelegraph.com/news/poly-network-hacker-returns-nearly-all-funds-refuses-500k-white-hat-bounty","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260331055353/https://cointelegraph.com/news/poly-network-hacker-returns-nearly-all-funds-refuses-500k-white-hat-bounty","credibility":3,"archive_timestamp":"2026-03-31T05:53:53+00:00"},{"url":"https://therecord.media/crypto-platform-poly-network-suspends-service-after-hack","name":"therecord.media","type":"other","archive_url":"http://web.archive.org/web/20260208230659/https://therecord.media/crypto-platform-poly-network-suspends-service-after-hack","credibility":3,"archive_timestamp":"2026-02-08T23:06:59+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-poly-network-hack-july-2023","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260516233004/https://www.halborn.com/blog/post/explained-the-poly-network-hack-july-2023","credibility":3,"archive_timestamp":"2026-05-16T23:30:04+00:00"},{"url":"https://dedaub.com/blog/poly-network-hack/","name":"dedaub.com","type":"other","archive_url":"http://web.archive.org/web/20260414022223/https://dedaub.com/blog/poly-network-hack/","credibility":3,"archive_timestamp":"2026-04-14T02:22:23+00:00"},{"url":"https://www.coindesk.com/tech/2023/07/02/polynetwork-attacker-issues-worthless-billions-in-shib-bnb-busd-in-latest-crypto-hack","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/poly-network-exploit-hackers/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://polynetwork.medium.com/the-poly-network-exploit-analysis-b0a77aff6078","name":"polynetwork.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251113122916/https://polynetwork.medium.com/the-poly-network-exploit-analysis-b0a77aff6078","credibility":3,"archive_timestamp":"2025-11-13T12:29:16+00:00"},{"url":"https://crypto.news/polynetwork-remains-suspended-24-hours-after-5m-hack/","name":"crypto.news","type":"other","archive_url":"https://web.archive.org/web/20260829131445/https://crypto.news/polynetwork-remains-suspended-24-hours-after-5m-hack/","credibility":3,"archive_timestamp":"2026-08-29T13:14:45+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/poly-network-hack","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260729201238/https://www.quillaudits.com/blog/hack-analysis/poly-network-hack","credibility":3,"archive_timestamp":"2026-07-29T20:12:38+00:00"},{"url":"https://polynetwork.medium.com/notice-of-complete-termination-of-poly-network-services-3470ef78d9d9","name":"polynetwork.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://neonewstoday.com/development/poly-network-announces-complete-termination-of-all-services/","name":"neonewstoday.com","type":"other","archive_url":"http://web.archive.org/web/20260311215740/https://neonewstoday.com/development/poly-network-announces-complete-termination-of-all-services/","credibility":3,"archive_timestamp":"2026-03-11T21:57:40+00:00"},{"url":"https://www.coindesk.com/tech/2021/12/07/most-influential-40-polynetwork-hacker","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/147059/poly-network-attack-conjures-billions-of-dollars-in-tokens-that-did-not-exist","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260308132556/https://decrypt.co/147059/poly-network-attack-conjures-billions-of-dollars-in-tokens-that-did-not-exist","credibility":3,"archive_timestamp":"2026-03-08T13:25:56+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:29.770937+00:00","updated_at":"2026-09-01T03:53:18.711534+00:00"}}