Share this article

Most Influential 2021: Polynetwork Hacker

For educating us on the difference between “hack” and “exploit.”

Updated May 11, 2023, 6:26 p.m. Published Dec 7, 2021, 2:08 p.m.
(Adam B. Levine/Pixelmind.ai)
jwp-player-placeholder

There is still much that is unknown about the largest decentralized finance (DeFi) security breach to date, the sophisticated attack that drained $600 million worth of cryptocurrencies from the China-based PolyNetwork, including the identity of the “hacker” (or hackers) and their underlying motivations. It was a story that riveted the industry, in part because the “Polynetwork hacker” ultimately returned all the stolen funds while communicating with the public the whole way through.

The article is part of CoinDesk’s 2021 Most Influential list.

“Mr. White Hat,” as the hacker referred to themselves in one message, said they attacked the cross-blockchain platform to call attention to an unidentified vulnerability and always intended to return the funds (minus a small bug bounty). But it’s just as likely he/she/they were forced to do the right thing after several crypto exchanges and USDT stablecoin issuer moved to blacklist the funds.

Additional context: The crypto industry differentiates between a “hack,” which means breaking into a system, and an “exploit,” which leverages or makes vulnerable existing code.

(Kevin Ross/CoinDesk)
(Kevin Ross/CoinDesk)


More For You

DeFi risk management giant Gauntlet sees $380 million exit as OKX crypto campaign ends

Gauntlet's Tarun Chitra speaks on a CoinDesk virtual panel (CoinDesk)

Gauntlet noted that deposits are now back to same levels before the campaign, and has navigated large capital swings before due to incentive campaign endings, airdrops, and shifts in market conditions which regularly produce short-period swings in either direction.

What to know:

  • Gauntlet's TVL dropped 22.84% over seven days, erasing roughly $380 million in value, with the primary driver being the end of OKX's pre-deposit campaign on Katana rather than broader market stress — the outflows are predominantly stablecoins rotating out of incentive-driven vaults.
  • Despite the sharp number, Gauntlet says the swing is consistent with normal incentive cycle dynamics, pointing to a similar $775 million single-transaction deposit in October 2025 that fully recovered within ten days as evidence that the firm has navigated large capital movements before.