Attack, provocation, and return: the performance art of Poly Network hackers may accelerate the implementation of supervision
On August 10, the largest theft ever occurred in the DeFi field-the cross-chain interoperability protocol Poly Network was hacked, and a total of 610 million U.S. dollars in cryptocurrencies were stolen, including 302 million USDT, 55,000 ETH, and 2,000 Several types of tokens such as Bitcoin, and the assets on the three networks of Ethereum, BSC, and Polygon were almost looted in more than 30 minutes. In this hacking incident, the main victims are users who mine through the cross-chain aggregator O3 Swap. Currently, O3 Swap has suspended the cross-chain function.
Chasing and intercepting vs tipping off
The official Twitter of Poly Network issued a statement of the attack, posted the specific address of the hacker on different chains, and called on miners and cryptocurrency exchanges to blacklist the tokens of the hacker address. Afterwards, all parties voiced their support. Binance CEO Changpeng Zhao, OKEx CEO Jay, and Hufu CEO Wang Ruixi all expressed their views on this matter. Tether CTO Paolo Ardoino tweeted that Tether has frozen the hacker address of 33 million USDT that attacked Poly Network.
Although the hacker's address has been chased and intercepted by many parties, the hacker still "cleaned" some assets. What's more dramatic is that a community user hanashiro.eth reminded the hacker that USDT has been blacklisted and should not use USDT any more through transaction messages , and then the hacker transferred 13.37 ETH to the hanashiro.eth address as a "gift in return". After hearing the news, a group of opportunists came and sent chain information to the hacker's address, trying to get rewards by helping the hacker, and began to send the hacker Called "Etherhood". What is even more unexpected is that Hanashiro donated all the received ETH, and also left a very literary poem and lyrics on the chain, which is more like completing a performance art.
Dialogue between the two parties, the hacker is ready to return the assets
Poly Network tweeted that after an initial investigation, the cause of the vulnerability has been found. The hacker exploited a loophole between contract calls, and the attack was not caused by a single custodian as rumored. Roxe payment network technology VP Jesse also believes that the theft of Poly Network is mainly due to code loopholes in smart contracts. Jesse pointed out that DeFi is originally a dark forest, and many people with ulterior motives have been watching secretly. Even after some vulnerabilities are discovered, attackers will not take action immediately, but choose to wait for more suitable opportunities, just like the incubation period of a virus. Waiting for greater profit opportunities. There must be many unknown vulnerabilities, but they haven't exploded yet.
After the assets were stolen, Poly Network tried to establish communication with the hackers, and hoped that the hackers would return the stolen assets, and claimed that some DeFi tokens had been retrieved. Subsequently, the security company SlowMist also released a report saying that they had identified the attacker's mailbox, IP and device fingerprints. Other reports have pointed out that DeFi funds are tied to central entities, so it is possible to track down the attackers.
In the early hours of August 11th, the hacker who attacked Poly Network responded: "If I transferred the remaining coins, it would be at the billion-dollar level. Didn't I save the project? I'm not very interested in money, and now I'm considering returning some Tokens, or leave them here". Then he said, "What if I make a new token and let the DAO decide where the token goes."
The response was slightly provocative. But what is unexpected is that the hacker actually stated in the latest transfer (block height 13001578 and block height 13001573) that he was ready to return the assets, but because he could not contact the Poly Network project party, he hoped that Poly Network would provide a multi-signature wallet . The hacker also said, "Obtaining so much wealth is already a legend, and saving the world is an eternal legend. I have made a decision not to use DAO any more." According to the transfer, it is preparing a public multi-signature wallet controlled by Poly Network. So far, this hacking incident, which is enough to be recorded in the history of blockchain security, can be regarded as a successful conclusion, but the capital security of blockchain and DeFi has once again sparked heated discussions.
Tether freezes USDT, is the user's assets still safe?
In this incident, Tether's approach stopped the hacker's cleansing operation in time, but it also sparked heated discussions on "Should Tether freeze assets?" "Where is the boundary of decentralization?" Roxe payment network technology VP Jesse said that both centralization and decentralization have their own strengths and weaknesses. Users hope to have 100% independent control of assets, and hope that if there is a problem, someone can help find it. Just as Tether has always been questioned and criticized by centralization, but every time it steals or loses coins, it has to rely on these centralized methods to reduce losses.
Compared with traditional industries, the development time of DeFi is relatively short, and there are still many areas to be improved, and it cannot provide good security protection like government-backed banks. The biggest advantage of DeFi is trust, but this trust is based on code. Ordinary users are not security experts, and they have no ability to identify whether the code is safe. They can only rely on the audit of security companies, but this does not guarantee 100% security. Hackers have a lot of code knowledge, and most attacks are caused by the huge inequality of knowledge between the two parties.
For DeFi investors, it is necessary to protect their private keys, not disclose them, and prevent them from being lost. Also, choose good projects and audited contracts whenever possible.
In order to avoid being attacked and protect the security of user assets, Roxe Chain has improved the algorithm of the threshold key and the mutual verification of communication between different chains. For cross-chain assets, Roxe's settlement nodes (cross-chain gateways) must comply with the Roxe protocol to review the issued asset mapping requests. At the same time, Roxe not only uses pure technical means, but also includes a series of authorization and audit mechanisms to ensure that all businesses of authorized nodes are included in periodic audits. At the same time, in order to maximize the protection of the rights and interests of Roxe users, Roxe has also invested a lot of energy in legal supervision, compliance, personal privacy, anti-money laundering, and anti-fraud.
Frequent security incidents may speed up the landing of regulatory boots
In the currency circle, DeFi is the hardest hit area for hacker attacks. According to a report by cryptocurrency intelligence company CipherTrace, overall cryptocurrency fraud and crime have fallen sharply in the first seven months of this year, but the losses caused by DeFi hacks are 270% higher than last year.
However, the theft incidents in the cross-chain field were rare before, and this incident shows that hackers have already set their sights on the cross-chain track. Since July, ChainSwap has been attacked twice, and then Anyswap has also been attacked. Frequent security incidents may speed up the process of regulatory boots landing in various countries. In this regard, Roxe payment network technology VP Jesse said: "In the long run, supervision is beneficial to the development of the industry. As the blockchain industry continues to mature, it is the general trend for countries to strengthen supervision, which is also a sign of industry maturity."
