The saga might finally be over. Poly Network today announced "Mr. White Hat," the hacker who stole more than $600 million worth of cryptocurrency from it on August 10, has returned the last of the stolen assets to the decentralized finance company.
"At this point, all the user assets that were transferred out during the incident have been fully recovered," Poly Network said in the announcement. Now it's purportedly "in the process of returning full asset control to users as swiftly as possible."
Mr. White Hat started returning the stolen cryptocurrency the day after the hack. They used the transactions that followed to communicate with Poly Network, the decentralized finance community, and other groups interested in the theft.
A similar message was conveyed in the final transaction with Poly Network. (Complete with another Batman reference.) Here's a segment of the message as provided by the Etherscan transaction logging platform:
"MY ACTIONS WERE DETERMINED SINCE I MADE THE FINAL DECISION, WHICH WAS TO MAKE IT PERFECT AND TO BE THE ETERNAL, INCLUDING PUBLISHING THE FINAL KEY TODAY. HOWEVER, ONE THING IS MISSING. DURING ALL THE NEGOTIATION, MY _ONLY_ REQUEST, WHICH WAS ALSO THE ONLY REASON FOR SLOW REFUND, WAS TO UNLOCK THE USDT. IN MY SELFISH VIEW, THE STORY IS TAINTED BY THE LOCKED USDT. IT WOULD HAVE BEEN A PERFECT EXAMPLE OF BUILDING TRUST BETWEEN ANONYMOUS 'ADVERSARIES' BY LEVERAGING THE POWER OF SMART CONTRACT, IF WE HAD ANY CHANCE TO DEAL WITH THE USDT IN A NOT CENTRALIZED WAY. IT WAS JUST MY PREFERENCE OF SOLVING THE USDT ISSUE, AND IT MIGHT NEVER HAPPEN DUE TO THE UNSYNCHRONIZED COMMUNICATION. IT'S FAIR ENOUGH TO JUST LEAVE THE USDT HERE AS A SIN OF UNTRUST. WE DON'T HAVE TO WORRY ABOUT THE IMPERFECTIONS, BECAUSE THE COMMUNITY, THE MEDIA, THE CROWD AND YOU AND ME CAN'T WAIT FOR THE FINAL KEY, RIGHT?"
They provided the final key to the wallet, which Poly Network successfully used to recover the stolen assets, per its announcement.
Mr. White Hat also said they "poured [Poly Network's] bounty and my compensation fund from donations into the shared multisig wallet" and requested that the company distribute "the extra assets to the 'survivors'" of this entire ordeal.
Poly Network had previously offered a $500,000 bounty for revealing the flaws in its platform; it also offered the hacker a position as its Chief Security Adviser. Mr. White Hat then signed their final message to the company using that title.
Poly Network said that it "will gradually resume cross-chain functionality for all the assets, along with other functions, subject to full security confirmation" after all of the stolen assets have been returned to their rightful owners.
Or at least most of the stolen assets—the stolen USDT is still frozen. However, Poly Network said it's coordinating with Tether to unfreeze the funds so they can be returned to users and finally bring this bizarre (and admittedly entertaining) story to a close.
