4 ms·

I am unable to find a satisfactory answer for the following: Whose money was stolen? PolyNet's? Random user? Someone "betting/buying" on a contract? What is C

I am unable to find a satisfactory answer for the following: Whose money was stolen? PolyNet's? Random user? Someone "betting/buying" on a contract? What is Curve.fi and why is transferring the proceeds there advantageous for the hacker?

22c 5y ago
Scant details in the article and I suggest waiting for a better write-up, I'm just a punter. I've never heard of poly.network but based on what I can see here, it seems likely that this was related to a cross-chain bridge. ie. they run their own network and the assets on that network were "bridged" in from other networks. Bridged assets are really held in custody at the bridge while a "copy" of that asset goes off to the other networks and does things, eventually that "copy" comes back to the bridge and gets destroyed, then custody of the asset you bridged is released back to the original network. In this case it seems like someone was essentially able to provide forged "custody papers" of bridged assets that came in from BSC and ETH mainnet and were floating around on Polygon and then was able to "unbridge" assets back to BSC and ETH mainnet. The people affected are presumably anyone who had used poly.network bridge to bridge assets from either ETH mainnet or BSC over to Polygon. curve.fi can basically be thought of as a bank (or really a provider of interest earning bonds). The really bizarre thing here is that the "hacker" doesn't even try to cover their tracks before putting money straight in the bank. The funds are dirty, we can only speculate that curve may not want to touch these coins and is possibly figuring out how to "quarantine" them as there's every possibility that other "big boys" may follow Tether on blocking redemption. There are well-known methods of washing funds, so it's possible the "hacker" wasn't really all that experienced but somehow "stumbled" upon the keys to the vault, so to speak.

22c 5y ago

Scant details in the article and I suggest waiting for a better write-up, I'm just a punter. I've never heard of poly.network but based on what I can see here, it seems likely that this was related to a cross-chain bridge. ie. they run their own network and the assets on that network were "bridged" in from other networks. Bridged assets are really held in custody at the bridge while a "copy" of that asset goes off to the other networks and does things, eventually that "copy" comes back to the bridge and gets destroyed, then custody of the asset you bridged is released back to the original network. In this case it seems like someone was essentially able to provide forged "custody papers" of bridged assets that came in from BSC and ETH mainnet and were floating around on Polygon and then was able to "unbridge" assets back to BSC and ETH mainnet. The people affected are presumably anyone who had used poly.network bridge to bridge assets from either ETH mainnet or BSC over to Polygon. curve.fi can basically be thought of as a bank (or really a provider of interest earning bonds). The really bizarre thing here is that the "hacker" doesn't even try to cover their tracks before putting money straight in the bank. The funds are dirty, we can only speculate that curve may not want to touch these coins and is possibly figuring out how to "quarantine" them as there's every possibility that other "big boys" may follow Tether on blocking redemption. There are well-known methods of washing funds, so it's possible the "hacker" wasn't really all that experienced but somehow "stumbled" upon the keys to the vault, so to speak.