- A flaw in a cross-chain bridge allowed digital assets worth more than $600 million to be taken within hours.
- The attacker began to return part of the loot, something very unusual in attacks of this kind.
- The deeper lesson: crypto has no deposit guarantee, and the risk lies in custody and in the code.
On 10 August 2021 Poly Network, a protocol that lets digital assets move between different blockchains (among them Ethereum, Binance Smart Chain and Polygon), announced that it had been attacked and that assets worth more than $600 million had been taken. Initial estimates spoke of about $610 million, making the episode one of the largest thefts known in decentralised finance.
The most striking part came afterwards: the attacker began returning funds within hours and, according to the analytics firm Elliptic, had already restored about $258 million by 11 August. A significant part, more than $200 million, remained unrecovered, locked in an account protected by a password known only to the attacker, and the platform itself publicly asked for its return.
What a cross-chain bridge is
Cryptocurrencies live on separate networks that, by design, do not talk to each other. A bridge solves that problem: it locks an asset on one chain and issues its equivalent on another, so the user can move it without selling it. For this to work, the bridge holds large amounts of assets in its contracts, and whoever controls those contracts controls the funds. Users do not see the bridge: all they notice is that their asset appears on the other network, and they trust that secure custody lies behind it.
According to early analysis, the attacker managed to manipulate functions that govern those contracts and, through them, authorise movements that should never have happened. Bridges concentrate value and complexity at the same time, which makes them an attractive target for criminals. A prior audit of the code reduces the risk, but does not eliminate it. That is why an asset should not be assumed safe just because its code has been audited.
An unusual return
In most attacks of this kind the funds are lost for good: they are scattered across addresses, mixed or quickly converted into other assets. That the culprit decides to return a part, whatever the motive, is an exception and not a rule, and there is no way of knowing how far the restitution will go.
Nor is there a clear framework to turn to. No body guarantees what has been lost, and identifying and prosecuting the authors, when possible, is slow and complex. Recovery depends on whoever took the assets choosing to cooperate or on the authorities managing to trace them. It is a clear contrast with the traditional financial system, where transactions can be blocked, reversed or investigated with well-established legal tools.
What it teaches businesses and families
Bank deposits are covered by a guarantee fund up to €100,000 per depositor and institution; crypto-assets are not. The Bank of Spain and the CNMV have warned on several occasions that these products are neither regulated nor specifically protected. In September 2020 the European Commission proposed a regulation for the sector, known as MiCA, which is still going through the legislative process.
Anyone who already has exposure to crypto-assets would do well to be clear about where they are held, who controls the keys, which platforms act as intermediaries and what technical risks are taken on each. This note is for information only and is not an investment recommendation, either to buy or to sell. The cost of a poor custody decision can be total and, in most cases, irreversible.
In this world the code is the rule, and also the main risk.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
