The Poly Network logo displayed on a phone screen with a physical representation of some cryptocurrencies.
Jakub Porzycki | NurPhoto via Getty Images
Nearly all of the $600 million stolen in one of the biggest cryptocurrency heists ever has now been returned by hackers.
Poly Network, the crypto platform targeted in the attack, said Thursday that all of the funds bar $33 million worth of the digital coin tether had been transferred.
The issuer of tether, a so-called stablecoin pegged to the U.S. dollar, used a built-in failsafe to freeze the assets soon after the theft.
In an unusual turn of events Wednesday, an anonymous person claiming to be the hacker said they were “ready to return” the funds. The identity of the hacker, or hackers, is not yet known.
Poly Network requested they send the money to three digital currency wallets. And, sure enough, the hacker had returned more than $342 million of the funds to those wallets by Thursday.
But there’s a catch. While almost all of the haul has been sent back to Poly Network, the last $268 million of assets is currently locked in an account that requires passwords from both Poly Network and the hacker to gain access.
“It’s likely that keys held by both Poly Network and the hacker would be required to move the funds — so the hacker could still make these funds inaccessible if they chose to,” Tom Robinson, chief scientist of blockchain analytics firm Elliptic, said in a blogpost Friday.
In a message embedded in a digital currency transaction, the suspected hacker said they would “provide the final key when _everyone_ is ready.”
Poly Network is what’s known as a “decentralized finance,” or DeFi, system. DeFi projects aim to use blockchain — the technology which underpins most cryptocurrencies — to replicate traditional financial services like loans and trading.
In Poly Network’s case, the DeFi system allows users to transfer tokens from one blockchain to another.