Poly Network hack
A cross-chain protocol exploited for about $611M in August 2021 — one of the largest DeFi thefts ever. Unusually, the attacker (dubbed 'Mr. White Hat') returned nearly all of the funds over the following days.
Also known as: Poly Network, Mr White Hat
Summary
Poly Network is a cross-chain interoperability protocol. In August 2021 an attacker exploited a vulnerability in its contracts to move about $611 million in assets across the Ethereum, BNB Chain, and Polygon networks — at the time among the largest decentralized-finance thefts on record. [1][2]
Unusual aftermath
Over the following days the attacker — whom Poly Network addressed as "Mr. White Hat" — returned nearly all of the funds, communicating via on-chain messages and saying the hack was done "for fun". Poly Network offered a $500,000 bounty and even proposed an advisory role; security firm Elliptic helped trace the assets. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
