Shall We Play a Game, Asks Poly Network Hacker Upon Returning the Funds

By Sead Fadilpašić

As nearly all stolen funds from the massive hack of the decentralized finance (DeFi) interoperability protocol Poly Network have been returned, the hacker continued their Q&A session, consciously providing some clues about their identity - as well as saying they have been offered half a million dollars by the protocol in reward money.

The hacker, embedding the messages in Ethereum transactions, alleges that the Poly Network said the attackers action constitutes white hat behavior, and that they plan to offer them a USD 500,000 completely legal bug bounty reward after all the funds are back with the protocol.

Also we assure you that you will not be accountable for this incident [...] and we will publicly express our gratitude to you, the team allegedly said.

The attacker went on to say that they had to overcome their arrogance and greed, and not forget the original plan - to return the money - as they were aware that they were hurting many people while holding it.

They also claim that they are not worried about their identity being exposed, even giving some personal descriptions: not a native English speaker, a high profile hacker, and working in the security industry. Then they said shall we play a game？ The attacker promised to give their personal gift to anyone who finds their social identity in one month.

Even if I am identified, I am still proud of my integrity, the hacker wrote.

Meanwhile, the Poly Network started calling the attacker Mr. White Hat, as seen in the letter they shared yesterday with the community in which they said that their main goal is recovering all the stolen user assets.

Answering if hes a white hat or a black hat, the hacker said that they enjoy the feeling of superiority by judging others, but its never easy. Not only lawful good can be white had. So-called black hat can also be a nice guy, suggesting that people are multifaceted.

Just three hours after this protocols post, the team shared that all the remaining user assets on Ethereum (except for the frozen USDT) had been transferred to the multisig wallet controlled by Mr. White Hat and Poly Network team.

The post also says that the repayment process hasnt been completed, and that they continue to communicate with the hacker actively to receive the final key.

As a reminder, the hacker asked for a secured, multisignature wallet to be provided for the returned funds. This type of a wallet has two or more users controlling it, each with their own private key.

As for the frozen USDT, promptly after the attack had been made known, Tether froze some USD 33m coins.

As reported, Poly Network suffered an exploit on August 10, on Binance Smart Chain (BSC), Ethereum (ETH), and Polygon (MATIC) - with the attacker stealing more than USD 600m. They begun returning the funds a day later, and by yesterday, they had given back nearly USD 342m, while USD 268m had been left on Ethereum to be returned.

Its unclear, however, if the hacker would pay back some ETH 13.37 (USD 42,875) he had given as a tip.

just setting up my twttr

— jack⚡️ (@jack)

_