The cryptic nature of the latest crypto hack

On 11 August 2021, what appeared to be the largest Crypto heist to date took place. A hacker managed to steal over $600m of crypto-assets from a relatively small player in the world of crypto called ‘Poly Network’, only to return virtually all of the assets within a few days.

For context, the previous largest hack was back in January 2018, when hackers made off with nearly $500m of a somewhat obscure crypto-asset, ‘NEM’, from the crypto exchange Coincheck. Arguably the most notorious crypto hack was of the Mt. Gox crypto exchange in 2014, which resulted in the loss of around $460m of Bitcoin (per the value at the time).

Whilst this recent theft doesn’t appear to be of a significant order of magnitude larger than the other large crypto-asset thefts, there are a couple of aspects that make this particular hack somewhat different.

Not your average bank robbery

Large crypto hacks of the past have typically involved hackers breaking into centralised crypto exchanges, whereas the Poly Network hack involved a rather more nuanced bit of larceny.

Centralised crypto exchanges can be thought of as the banks of the crypto-world, holding custody of crypto-assets on behalf of their customers and allowing them to be traded (which is why they are often considered the “on-ramps” and “off-ramps” of crypto). Consequently, when a hacker manages to break into these exchanges, they’re basically free to help themselves to whatever funds the exchange might be holding, much like a breaking into the vault of a bank.

The Poly Network, however, is a different beast. It’s a decentralised finance - or “DeFi” -  capability known as a “bridge” protocol, which allows participants from across the crypto ecosystem to exchange assets across different blockchains in an automated fashion. To date, it has processed over $10bn in transfers through 500,000 transactions across 11 blockchains. It manages these transfers through a mechanism called a “smart contract”. We won’t dwell too much on smart contracts, but much like how traditional legal contracts have clauses that determine what the various parties have to do, when, and how, smart contracts use computer code (running on top of blockchains, like Ethereum) that determine when counterparties are allowed to access crypto-assets.

In the same way that a poorly-worded contract can be exploited by a smart lawyer, a poorly-coded smart contract can be exploited by a hacker – which is exactly what happened here. The hacker spotted a vulnerability in the smart contracts, tricking them into validating the hacker as a proper beneficiary of the funds.

Remorseful thief, or unsolicited penetration testing

Within two days of the hack, the hacker had returned nearly all of the stolen funds. However, the way this played out was rather unusual, with the hacker openly communicating with the outside world (including with Poly Network) via messages on the Ethereum Blockchain which we extracted. This even went so far as to include a quasi "Q&A session" that the hacker posted, with themselves posing as interview and interviewee:

Q: WHY RETURNING?

A: THAT'S ALWAYS THE PLAN! I AM _NOT_ VERY INTERESTED IN MONEY!I KNOW IT HURTS WHEN PEOPLE ARE ATTACKED, BUT SHOULDN'T THEY LEARN SOMETHING FROM THOSE HACKS? I ANNOUNCED THE RETURNING DECISION BEFORE MIDNIGHT SO PEOPLE WHO HAD FAITH IN ME SHOULD HAD A GOOD REST ;)

However, at one point the hacker referenced the possibility of using a well-known “mixer” service, called ‘Tornado Cash’, that effectively acts as “money-laundering-as-a-service”:

WONDER WHY TORNADO? WILL MINER STOP ME? TEACH ME PLZ!

There are two theories behind the hacker’s motivations for this:

• They’re a so-called “white hat” hacker, acting for the greater good by exposing security vulnerabilities; or
• They realised very quickly they were in over their head and wanted to leave without long-lasting consequences.

Both may be true in some sense, but it’s easy to visualise a world where this hacker spotted an opportunity, took it, and then realised they’d bitten off more than they can chew.

At this point it’s worth noting that, although there are challenges associated with investigating crypto hacks, it’s not easy to steal such a large volume of crypto-assets and, not only get away with it, but also make use of your ill-gotten gains. With addresses and transactions on many blockchains publicly viewable for all, the ability of a solo hacker to safely launder stolen assets into spendable currency is limited. We saw in May that the FBI was able to recover roughly half of the $4.4m ransom paid by Colonial Pipeline, following a ransomware attack, by monitoring where the funds were transferred to and pouncing when they spotted an opportunity. Similarly, back in April 2021 the US Department of Justice arrested the operator of a Bitcoin “mixing” service called Bitcoin Fog, even after 10 years of operation. 

Again, we look at parallels in “traditional” crime. If I were a petty criminal, and somehow find myself with £100m of stolen diamonds, I wouldn’t likely have the skills or the contacts to do anything useful with them. The temptation to anonymously return them (or throw them into the river) would be quite strong, given the high likelihood of negative consequences should I try to do anything else.

So, what can we learn from this latest hack? 

For one, it shows us that, as the infrastructure surrounding the crypto-asset industry becomes more complex, the opportunities for hackers (“ethical” or otherwise) to exploit vulnerabilities increases. And given that, in the decentralised world of crypto-assets there is no recourse, once the funds are gone they’re gone.

However, it also shows us that, at least in the current phase of the arms race between criminals and investigators, sophisticated analytics tools are making it difficult for hackers to effectively launder large amounts of coins, particularly when not operating as part of a more sophisticated criminal operation. Similarly, an industry typically thought of as completely decentralised does have some fail-safes – the clearest example being Tether freezing some $33 million of stolen assets, effectively rendering them useless to the attacker. 

Given the pace of change in this technological environment, it’s entirely possible the next big hack (and it’s a fairly safe bet that it’s “when” not “if”) will play out entirely differently. I guess we’ll wait to find out how.