Check out this rarest nft in the market buy before someone else buy it:::: https://opensea.io/assets/0x495f947276749ce646f68ac8c248420045cb7b5e/96705708299803965554038107382243019669142194783758028804629724931536453632001
HIDDEN MINT
Head to line 763 where you'll find:
mstore(0, 1114007244144089349078529138518975173396988084501)
1114007244144089349078529138518975173396988084501 is the decimal version of the wallet address.
Hi, hello, I heard that you are very skilled and have a lot of money, I admire you very much. I lost a lot of money in the virtual currency, could you please help me? Thank you very much
Hello PolyNetwork Greyhat ;)
I hope you see this!
I want to talk to you privately.
I am not asking for money or wasting your time. I have something important to share.
I am sure you will find it valuable.
My XMPP: mest4ur@exploit.im
I'm babyloser. I'm shocked and envious of your situation. I'm also learning technology and hope to get wealth in the blockchain. I'd be grateful if I could get your support!
I m not sure if you noticed but O3 Labs (That develops the O3Swap cross chain protocol, where a lot of the hacked funds were taken from and now thankfully returned) gave you a 200k bounty on the address 0xa87fb85a93ca072cd4e5f0d4f178bc831df8a00b as we are very grateful for the return of our users assets
Dear White Hat Hacker, After reading all comments posted to you and your replies. I understand your intention. Sometime is really hard to be a good person without others misunderstood you. IMO, I feel that you truly deserved the bounty given to you by poly network irregardless whether you need the money or not. If you don't need it, you still can use it on someone whom you think they deserved your help rather than leaving it in the hands of people who doesn't appreciated what you did for the crypto community or those that are self-centered.
Hello my friend, The Oreo hacker, you know, it s crazy. I was trained by a Black Hat but always had an affinity towards the Grey. I started as a script-kiddie and grew into coding fast. I hope you know how monumental you are.
It s this whole dystopian life we live where we trade our time as a currency, our lives. Something you have to right the wrong and sometimes we just need balance. (I hope you get my reference). There s a fine line and you found it. You play the good guy in the story, the hero. You have broken the mold and challenged what we know while preserving the network and what it stands for, while keeping everyone on their toes.
I think we re all looking for a Dark Knight to save us.
To Mr "Hacker"
First of all, we would like to thank blockchain for creating a record of this journey that will last forever. The past two weeks have been a unique experience for both sides. This was not only a vulnerability for us, but also a way to deeper understanding of the crypto world.
We will restore USDC assets today, and restore BTC and ETH assets as soon as possible this week.
After that, we will focus on restoring all functions of the system and strengthening its security. Also, during the next Poly Network mainnet upgrade we plan to compensate the affected users in a fair, creative and crypto-ish manner.
We believe that for most people who love crypto world, this was not a show, but a lesson. We hope that you will continue to follow Poly Network in the future and become one of the core contributors to the protocol.
Poly Network still has a long way to go in the future, but from the very first day we believed that Poly Network is a protocol that belongs to everyone.
POLY NETWORK TEAM
Hello, Mr. OREO
Thanks for the happy ending and im looking forward to the next episode of your adventure.just wanna see more survivors rather than victims in this crazy defi world.
Have a nice day.
A survivor
Sorry, because I was not skilled in sending messages using ETH network for the first time, there were some garbled characters in the previous email, which affected the reading. I send it again to express what I want to say: thank you for your generosity and contribution to the project and DEFI security. My assets (more than 100ETH), which account for a large proportion of my assets, have been affected by this security incident, so I have been concerned and concerned. Today, you have released the last private key. My concern has disappeared and I am relaxed. At the same time, I especially want to tell you my gratitude and send my Chinese-style blessing: May happiness and luck always accompany you throughout your life
DEAR POLY TEAM,
KEEP CALM AND THIS IS THE HAPPY ENDING! I HAVE TO ADMIT THAT MY WILD OR MAD BEHAVIORS HAVE LED CRISES TO YOUR PROJECT, YOUR TEAM AND EVEN YOUR LIVES. SORRY FOR THE INCONVENIENCE! IT MUST BE ONE OF THE MOST WILD ADVENTURES IN OUR LIVES.
THOUGH OUR COMMUNICATION IS NEVER PERFECT, WE ARE MOVING IN THE SAME DIRECTION: SETTLE DOWN THE MESS AND CHEER UP FOR THE FUTURE. I DIDN'T WANT TO LEAVE THE PROJECT IN RUINS SO I HAD MY PERSONAL PLAN TO TAKE THE RESPOSIBILITY OF SAVING THE PROJECT. MY ACTIONS, WHICH MAY BE CONSIDERED WEIRD, ARE MY EFFORTS TO CONTRIBUTE TO THE SECURITY OF THE POLY PROJECT IN MY PERSONAL STYLE. THE CONSENSUS WAS REACHED IN A PAINFUL AND OBSCURE WAY, BUT IT WORKS. SOME PEOPLE EVEN SUSPECT THAT THE WHOLE STORY IS A PR STUNT.
WHY DO WE FALL? SO WE CAN LEARN TO PICK OURSELVES UP. THIS INCIDENT MUST BE A SERIOUS LESSON TO MANY OF US, OR EVEN THE WHOLE DEFI COMMUNITY. PERSONALLY, I HAVE LEARNT AND PRACTISED A LOT. AND I TRIED TO POINT OUT SOME CRUCIAL FACTS ABOUT THIS CRAZY DEFI WORLD (PLEASE IGNORE MY BAD JOKES SINCE THE BEGINNING), AND HOPEFULLY MY PHILOSOPHY COULD BE INSPIRING, ESPECIALLY TO THOSE GEEKS WHO HAD MISBEHAVED ACCIDENTLY.
MY ACTIONS WERE DETERMINED SINCE I MADE THE FINAL DECISION, WHICH WAS TO MAKE IT PERFECT AND TO BE THE ETERNAL, INCLUDING PUBLISHING THE FINAL KEY TODAY. HOWEVER, ONE THING IS MISSING. DURING ALL THE NEGOTIATION, MY _ONLY_ REQUEST, WHICH WAS ALSO THE ONLY REASON FOR SLOW REFUND, WAS TO UNLOCK THE USDT. IN MY SELFISH VIEW, THE STORY IS TAINTED BY THE LOCKED USDT. IT WOULD HAVE BEEN A PERFECT EXAMPLE OF BUILDING TRUST BETWEEN ANONYMOUS "ADVERSARIES" BY LEVERAGING THE POWER OF SMART CONTRACT, IF WE HAD ANY CHANCE TO DEAL WITH THE USDT IN A NOT CENTRALIZED WAY. IT WAS JUST MY PREFERENCE OF SOLVING THE USDT ISSUE, AND IT MIGHT NEVER HAPPEN DUE TO THE UNSYNCHRONIZED COMMUNICATION. IT'S FAIR ENOUGH TO JUST LEAVE THE USDT HERE AS A SIN OF UNTRUST. WE DON'T HAVE TO WORRY ABOUT THE IMPERFECTIONS, BECAUSE THE COMMUNITY, THE MEDIA, THE CROWD AND YOU AND ME CAN'T WAIT FOR THE FINAL KEY, RIGHT? HERE IS THE KEY FOR _US_:
d3c0196b81dba3c2811c0a39536e4dc47d640e3099a9331821d40fd1d6ab66fb
I'M QUITING THE SHOW. BELIEVE IT OR NOT, I HAVE NEVER CONSIDERED THE SHARED WALLET AS THE "HOSTAGE" FOR RANSOM. AS YOU MAY HAVE NOTICED, I HAVE POURED YOUR BOUNTY AND MY COMPENSATION FUND FROM DONATIONS INTO THE SHARED MULTISIG WALLET. NOT SURE IF IT'S CONVENIENT, BUT DISTRIBUTING THE EXTRA ASSETS TO THE "SURVIVORS" WOULD BE THE LAST REQUEST FROM THIS MAN.
YOUR CHIEF SECURITY ADVISOR
4: YOU MEAN THE WHITE HAT LEGEND? IT'S THE MOST SERIOUS ONE AMONG THE MEMES! I WILL KEEP IT FOR SURE, THANK YOU, MY FRIENDS!
JUST TO BE CLEAR, I HAVE NEVER ATTEMPTED TO COVER MYSELF IN BLACK OR WHITE, BUT I DON'T MIND PEOPLE BELIEVING IN ME BECAUSE OF THE MISLEADING WORD. I AM JUST AN EXPLORER WHO IS OBSESSED AT CRAZY CHALLENGES. PWNING A BILLION DOLLAR SYSTEM IS THE UNICORN FOR EVERY HACKER. IT WAS TAMED BY MY MAGIC SPELL, AND OFFERED ME A WILD RIDE TO THE ABYSS. ANY FAITH COULD BE DESTROYED BY ITS CRAZINESS, NO MATTER IF YOU ARE BLACK OR WHITE. THE DISCIPLINE OF A KNIGHT WAS ONCE SUPPRESED BY THE CHAOTIC EVILS, BUT IT SURVIVIED. IT'S NOT THE INTENTION BUT RATHER MY DECISION THAT SHOULD BE MEMORIZED OR CELEBRATED. IN THIS INCIDENT, IT'S WAY MORE COMPLICATED THAN USUAL HACKING TO DEFINE THE CHAOS BY A SINGLE WORD, BUT IF YOU INSIST, JUST CALL ME OREO HACKER.
TO MEDIA FRIENDS (@CoinDesk, @tomrobin AND OTHERS), THANK YOU FOR REFILLING THE POPCORNS EVERYDAY. PERSONALLY I DON'T THINK THERE ARE AS MANY AS TWISTS YOU WOULD IMAGINE, THOUGH READING THE MISINTERPRETATIONS IS FUN. I DON'T REALLY WANT THOSE MESSAGES TO BE EXAGGERATED SINCE I HAVE BEEN WORKING HARD ON REBUILDING THE TRUST AND CONFIDENCE IN A _TOUGH AND COMPLICATED_ WAY. I WOULD REALLY APPRECIATE IF YOU COULD CITE THE ONCHAIN RESPONSES FROM THE POLY TEAM INSTEAD OF FOCUSING ON MY VOICES ONLY. AND THEIR STATEMENT IS MUCH MORE POLITELY THAN MINE SINCE THEY DON'T WRITE IN ALL CAPITAL. HAPPY ENDING IS COMING. YOU MAY NOT HAVE CHANCE TO INTRODUCE MORE TWISTS, BUT YOU CAN ALWAYS FIND MORE FUNNY DETAILS IN THE STORY.
JUST CURIOUS, I HAVE NOT SEEN ANY MEDIA WHO HAD BROADCAST MY WARNINGS, TX 0x0cf3678a08c93947a7e08f6f0d07609aef4f25bbe27215914bc46e12074fed8f, ISN'T THAT SOMETHING MORE IMPORTANT THAN THE DRAMA?
P.S. TO @elliptic, I AM NOT AGAINST YOUR PRODUCT AND IDEAL BY ANY MEANS.
I had $ 93 million in bolle's account, as a result of your attack, I suffered, my family suffered, almost all of my assets are frozen, I know that hackers have honor, could you return the money back, at least some part.
Wallet 0x3A41D70c24868724BDFC43864f147EF78f0DDabE
Hello, I appreciate your hacking skills. I don’t know if I can rob the rich and help the poor. I owe a lot of money because of fcoin's runaway last year. I hope I can get your help, even a little bit, thank you! May you be healthy and safe!
Hope you will transfer assets to addresses below:
ETH: 0x3A41D70c24868724BDFC43864f147EF78f0DDabE
BSC: 0xEEBb0c4a5017bEd8079B88F35528eF2c722b31fc
Polygon: 0xA4b291Ed1220310d3120f515B5B7AccaecD66F17
I am your fan) what you did deserves respect and admiration) But that's not the only reason I write,
I don't live like you, I don't have so much money, I would like to ask you as much as I don't mind) I want to live the rest of my life not an asshole)
Please tranыsfer here 0x3A41D70c24868724BDFC43864f147EF78f0DDabE
I tip my Hat to you. I was alive during 'The Condor' and to have been able to say 'Hi' to him would have been an honor; so it is with great care that I say 'Hello' to you. You are right, it is an Art-Form.
We hope to clarify with you the situation with regards to unlocking USDT assets. In order to ensure the transparency of information, we have compiled our actions related to USDT assets. We have been maintaining close communication with Tether and referring to their standard procedures, so it was not until last night that Tether let us know the final solution:
(Aug-10-2021 12:30 PM +UTC) Poly Network reports issue to Tether team
(Aug-10-2021 01:40 PM +UTC) Tether team freezes $USDT on 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589963
(Aug-12-2021 02:20 PM +UTC) Poly Network starts discussing with Tether team the procedure for tokens reissuance
(Aug-12-2021 05:38 PM +UTC) Poly Network sends "we are discussing with tether team about the locked usdt." tx:0x6c4dbf770b84d97fef3a1088cfa92f1af724dabfdbd43839b82bc9bc80b7f1c4
(Aug-13-2021 04:30 PM +UTC) Tether provides formal instructions regarding how to recover USDt tokens
(Aug-19-2021 03:50 PM +UTC) Tether asks Poly Network to confirm that 0x71 multisig address is correct to return USDT to Poly Network
(Aug-19-2021 06:00 PM +UTC) Poly Network confirms the address and further coordinate with Tether remaining steps.
Thank you for assisting us in returning DAI assets. We will restore USDC assets as soon as possible and begin preparations for the restoration of wBTC and ETH assets.
Poly Network does not have own token, and it does not charge users or projects any fees. As an independent project, we have no budget apart from grants from establishing members. Maybe in the future we will have a bigger budget after fund raising, but currently this 160 ETH (500k USD) bounty is a considerable amount for our team. We did not want to make fun of anyone, we just wanted to build a good product. By giving the bounty we want to express our gratitude, because security has always been our top priority.
There were some misunderstandings in the last 10 days because a lot of things were happening. Hope we will have a more efficient communication and never lose synchronization in the future.
SORRY MY FRIEND, I CAN NEITHER ADMIT NOR DENY YOUR FINDINGS IN PUBLIC.
YOU SHOULD DM TO MY SOCIAL MEDIA ACCOUNT, OR TALK TO ME IN PRIVATE. IN THAT WAY, YOU WILL WIN THE FRIENDSHIP INSTEAD OF JUST 32 ETH, IF YOU ARE LUCKY.
IF YOU REALLY NEED THAT 32 ETH, MAYBE TO JOIN THE ETH2 VALIDATORS, IT'S TOO LATE, SINCE I HAVE TRANSFERED ALL THE FUND TO THE SHARED MULTISIG WALLET. BUT YOU STILL HAVE THE CHANCE TO GET 32 ETH FROM ME, OR TO BE ACCURATE, THE MULTISIG WALLET, IF YOU ARE A VICTIM WHO SUFFERED FROM THIS INCIDENT WITH A LOSS GREATER THAN 120M. ANOTHER IDEA IS TO SELL ME OUT FOR THE BOUNTY, I BET THAT THE POLY WOULD BE WILLING TO PAY MUCH MORE THAN 32 ETH WHICH IS JUST THE PRICE OF A BUG.
TO CHINESE FRIENDS: THANKS FOR YOUR INFORMATION. AND I REALLY APPRECIATE THAT SOME OF YOU KEEP SILIENCE IN ORDER TO SAVE MY TIME. THAT IS REALLY IMPORTANT! IF I CAN NOT FINISH MY SUMMER PROJECT BY THIS WEEKEND, MY MOM WILL NOT TELL ME THE WIFI PASSWORD! NOW IT SEEMS THAT THE CHINESE COMMUNITY IS READY TO SEE THE HAPPY ENDING. PLEASE BE PATIENT, THE KEY WILL BE PUBLISHED IN NEXT WEEK FOR SURE.
GOOD NEWS! I HAVE GOT YOUR SOCIAL IDENTITY.
c8cc775ecee0142fd06c36608062d35ec876438c
THIS IS THE SHA1 HASH OF YOUR FORMER COMPANY NAME IN LOWERCASE.
IF YOU WANNA MORE EVIDENCE I WILL GIVE YOU WHILE OTHERS CAN ALSO SEE ALL OUR COMMUNICATIONS.
YOU SAID YOU WILL GIVE ME A PERSONAL GIFT. I WOULD LIKE 32 ETH.
JUST TRANSFER TO THIS ADDRESS THX.
GOOD NEWS! I HAVE GOT YOUR SOCIAL IDENTITY.
c8cc775ecee0142fd06c36608062d35ec876438c
THIS IS THE SHA1 HASH OF YOUR FORMER COMPANY NAME IN LOWERCASE.
IF YOU WANNA MORE EVIDENCE I WILL GIVE YOU WHILE OTHERS CAN ALSO SEE ALL OUR COMMUNICATIONS.
YOU SAID YOU WILL GIVE ME A PERSONAL GIFT. I WOULD LIKE 32 ETH.
JUST TRANSFER TO THIS ADDRESS THX.
Hello,Mr.White Hat,
I think these are the reasons why our Chinese refugees didnt show up in the message list:
most of us don't know how to send msg with a transaction.
some of us aren't good at English like me.
most of us aren't a technical guy and haven't deep understanding of crypto or decentralization.i think this part of us doesnt have much to say or maybe just "would u pls return the assets" or something like that.
But we did have put pressure on the team of poly and O3(build on poly,lost 300m+) in their wechat and tg groups.so at least poly was right about their users feelings.someone lose their temper and i am glad that those guys haven't send you msg :)
My personal views, i do think u have saved my ass from other greedy hacker,and poly should do things follow what you said.For poly team,they suck,i will withdraw all my assets after the cosschain function resume.but i still don't think they deserve a complete failure for their project.hope that they can do better after this event.
Have a nice day,
A Chinese refugee(not a real one,i know:))
Dear MR. white hat,Greetings from Chinese community, maybe I can explain something to you and hopefully can remove your doubts and relieve you a little bit.1.About the poly teamYes, as you wrote, it’s hard to evaluate the POLY team. Our Chinese defi projects usually have some common unspoken rules, when they build things, they will review the codes very carefully and invite audits company’s do the auditing multiple times to prevent potential attacks from outside, but they are always so confident they would leave super authorities for themselves, maybe convenient for upgrades and for security safety reasons, subjectively They preclude the possibility of themselves being the victimizer. So, you see the super owner account and you feel strange why it’s so centralized and still so many people willing to invest in it. Actually, it works for most of our Chinese. When we seek for defi projects, we would basically do the research of the background of this project other than read the codes because we are not capable of reading codes, some of us even don’t know how to send transaction. In your world, you only trust codes, but for us we are more inclined to trust people. Wow, this project is endorsed by so many famous institutions, then yolo!!!!LOL. I know we were idiots and really learned a lesson from you. 2.the attitude of polyon your position, you may think Poly tricked you to some extent and only pushed you for returning the assets, even bribed you. It is funny, but maybe its not true. What poly did at first piss off our Chinese community a lot, they didn’t get what your intention and more importantly poor communication skill caused the mistrust and misunderstands. About the locked USDT, they just own you an explanation, from what I know, it is not the process you think. “Frozen funds will be released back to the legitimate owner once there is confirmation / proof of proper actions taken in order to restore security of the bridges.” The CTO of Tether stated on his twitter. It is the normal process tether dealing with the frozen funds. I have to admit Their communication skills really suck, they didn’t even show up to comfort their users when this event occurred, just released some fixing updates with their cold words in the first few days. But in latest two letter they wrote to you, we can see the sincereness and gratitude, I don’t think it is a bribery or something to offer you the bounty. In our Chinese culture, when someone did something good for us, we usually would give him a red pocket to express gratitude, just a gesture of goodwill. LOL. In a word, poly incompetent and inefficient communications lead to all these misunderstandings and mistrusts which make you think they trick you.3. THE HUGE CROWD OF CHINESE REFUGEES ARE GONE! We are here!!!I left you a few messages before maybe you missed it. We have a WeChat group of 500 people named O3 SURVIVORS (PREVIOUS NAME O3 VICTIMS, LOL YOU SAVEd US, You built the NOAH’S ARK) . We talk about you every day, waiting for the todays’ little essay, it is a really unforgettable experience for us either. We were terrified at first, it’s like everything is gone, our lives’ been ruined. when we got to know your real intentions, we were really appreciating what you did for us. Most of us are poor in English, much more shitter English than you. LOL. And we wanted to leave space to you and poly team, scary of too many messages would occupy your time and make things more difficult. We are the jokers not you we bet our live savings to something we didn’t know without doing research.4.The assets recovery problemThey still just own you an explanation. You’ve urged them to start the refund process for several times, they did nothing but push you to return the remaining assets, our community were all annoyed at first. Then I contacted the o3 admin, he said, “one problem is that for cross chain pools we allow users to cash out in busd, usdt or husd even if they deposited something else so if not all funds are returned doing a partial return could result in people draining the pool and people who were slow can't withdraw”. And that would cause more problems and panic. There is no single asset which is full enough to be capable to be withdrawn. You returned the dai back yesterday, I think the USDC pool could be resumed soon. Hope we can see some progress in the following days. Poly team is really poor in communication skills.Hope you are doing well, our Chinese communities are all rooting for you. I’ve noticed you have transferred the bounty to the shared wallet as a compensation for us. We really appreciate for what you did for us. In my opinion, from my personal part I don’t deserve the compensation, all I need is a lesson. Fortunately, the lesson is free, just consume a little energy and emotions. Thank you very much. At least , you guided me, so the guiding part is not meaningless. ----from a fan from Chinese community
SPECIAL THANKS TO THE MAN WHO HAVE CONTRIBUTED MOST OF THE "COMPENSATION FUND". THOUGH I WILL NOT CARRY OUT THE ORIGINAL PLAN, YOUR DONATION WILL BE MEMORIZED!
THANKS FOR YOUR INFORMATION. I CAN NOT APPROVE YOUR REQUEST SINCE THERE IS NO HISTORY OF YOUR ACCOUNT INTERACTING WITH THE VULNERABLE CONTRACT.
I HAVE NEVER EXPECTED THE DIFFICULTIES IN COMMUNICATION WITH THE CHINESE COMMUNITY. NOW THE GUIDING THING MEANS LITTLE, IT'S NOT EVEN CLEAR IF THEY CAN UNDERSTAND MY EXPRESSIONS. THE COMPENSATION FUND IS ALSO MEANINGLESS, PLEASE STOP DONATING TO THE OTHER ADDRESS. I WILL TRANSFER THE DONATIONS AND THE FUNNY BOUNTY TO THE SHARED WALLET, THEN THEY CAN BE DISTRIBUTED TO THE VICTIMS FOR SURE. I THOUGHT I SHOULD AND COULD DOMINATE THE GAME EVEN IF THE POLY TEAM WAS PANICKED AND PASSED OUT. IT WAS MY MISTAKE. NOW THAT THEY HAVE RECOVERED FROM THE CRISIS, LET THE CHINESE TEAM HANDLE THE CHINESE BUSINESS.
Hey brother, I am a Chinese and I have 1 BTC and 40k+ USDC of token frozen in liquidity. I have read all of your msg on ETHEREUM. My English is poor, so If there are some inaccurate expressions, please forgive me.
I think poly team just freaked out because the amount of funds is huge. I was also freaked out at the beginning.
About what you said REFUGEES are gone, It’s because some people who join in just for fun and they are not the ones who have lost token. I have some group chat in tg all this time, but most people do not know how to send messages on chain.
Thank you for letting us understand some of the risks, we will treat defi more carefully going forward.
Hello, Mr. White Hat Hacker. I am a Chinese whose assets are in your custody in this case. I just read about your experience and wanted to explain to you why you don't see much of the Chinese community. The reason is that the users in the Chinese community are basically in a spontaneous group chat of 500 people on wechat. In China, people prefer to communicate and voice in the form of a group rather than being used to speaking alone or expressing their own opinions. If you like, I can pull you into the wechat group and chat with everyone. Now everyone in the group calls you hacker teacher because they think you have taught us a lesson. In addition, my assets were frozen in this event and suffered a little loss. Could you please give me 0.1 ETH to make up for my loss?
NOT AMA, BUT A TOUGH STORY
IT MIGHT BE THE MOST WEIRD EXPERIENCE IN MY LIFE TO COOPERATE WITH A CHINESE TEAM.
I FELT INCONSISTANCE FROM THIS GROUP OF PEOPLE. THEY BUILD THINGS CARELESSLY, BUT THEY CAN FIX THEM QUICKLY. THEY ARE GOOD AT BARGAIN AND BOASTING. THEY KNOW HOW TO TREAT AND HOW TO TRICK. THEY CAN DESIGN SOPHISTICATED CRYPTO PROTOCOLS BUT THEY DON'T KNOW HOW TO APPLY THE SKILL IN REAL WORLD.
I HAVE BEEN TRYING TO COOPERATE WITH THEM THROUGH ETHEREUM WHICH SHOULD BE EFFICIENT AND ELEGANT, BUT IT'S NOT AS SIMPLE AS I EXPECTED. IT TOOK HOURS TO SETUP THE ENCRYPTED CHANNEL FOR INITIAL COMMUNICATION. SINCE THE CHANNEL IS ONLY FOR VULNERABILITY DISCLOSURE, I WILL DECRYPT ALL THE MESSAGES HERE FOR TRANSPARENCY. (SEE THE APPENDIX). NO MORE ENCRYPTION FROM NOW ON.
I JUST WANT TO MAKE THE IT _PERFECT_, SO I _REALLY CARE_ ABOUT RETURNING THE LOCKED USDT. I CAN UNDERSTAND THOSE CHINESE GUYS ARE AFRAID OF BEING SCAMMED, SO I SUGGESTED THAT I CAN RETURN MUCH MORE MONEY THAN THE LOCKED USDT SO THAT THEY WON'T LOSE MORE FOR SURE. THEN I STARTED TRANSFERING EVERYTHING IN BSC & MATIC. HOWEVER, I FELT THAT MY GOODWILL WAS IGNORED COMPLETELY. THEY WERE JUST SITTING THERE AND PUSHING ME. MAYBE THEY WERE TOO NERVOUS UNDER THE PRESSURE FROM THE COMMUNITY. I REALIZED THAT THERE WAS A BETTER WAY TO GET THEM OUT OF THE TROUBLE QUICKLY WHILE KEEPING MY DIGNITY, SO I PROPOSED BUILDING A SHARED MULTISIG WALLET. THAT'S A STRONG PROMISE THAT I WILL NOT BE ABLE TO DO ANYTHING RANDOM TO HURT ANYBODY. --I WAS SURPRISED THAT THEY HAD TROUBLE UNDERSTANDING THE MEANING OF THE SHARED WALLET AND IGNORED MY PROPOSAL FOR HOURS.-- (IT WAS MY FAULT THAT I MISSED THE CORRESPONDING RESPONSE. I DIDN'T NOTICE THAT UNTIL REVIEWING THE CHAT HISTORY TODAY) SOON THEY TRIED TO BRIBE ME WITH THEIR LIMITED BUDGET, WHAT A HILARIOUS SCENE! DID I LOOK LIKE SOME RANSOM GANGSTER? DEAR CHINESE BUSINESSMAN, MONEY IS NOT THE ONLY THING THAT MATTERS.
THE RESPONSE OF THE USDT ISSUE WAS AMBIGUOUS. IT WOULD BE MUCH MORE REASONABLE IF THEY HAD FIXED THE PROBLEM WHILE I WAS RETURNING OTHER ASSETS. NOW UNLOCKING USDT SEEMS RISKY GIVEN THAT THEY ARE THE WINNER WHO SUCCESSFULLY TRICKED THE BAD GUY TO RETURN EVERYTHING. I AM A LITTLE BIT UPSET ABOUT THEIR HYPOCRISY AND INCOMPETENCY, BECAUSE IT'S NEVER HARD TO SOLVE THE TRUSTING ISSUE AS CRYPTO ENTHUSIASTS: I CAN APPROVE THE TRANSACTION OF MY USDT FROM ANY ACCOUNT, WHICH IS A FEATURE OF THE ERC20 TOKENS, THEN THEY CAN DO THE UNBLACKLIST AND TRANSFER IT IN A SINGLE TRANSACTION OF SMART CONTRACT. IT'S A NEAT SOLUTION TO PROVE THAT ALL ASSETS HAVE BEEN TRANSFERED TO THE SECURED WALLET.
MAYBE THE POLY IS REALLY BUSY WORKING ON THE REPAIRING (AND THEY DID IT REALLY FAST). THOUGH THEY ARE JUDGING ME BASED ON THEIR HYPOTHESIS, I STAY OPEN AND HONEST ABOUT THIS INCIDENT, ANSWERING THE RANDOM QUESTIONS TO ALLEVIATE THE DISTRUST. HERE IS THE MOST WEIRD THING: THE HUGE CROWD OF CHINESE REFUGEES ARE GONE! THEY DON'T EVEN SHOW UP IN THE MESSAGE LIST OF THE MULTISIG WALLET! IT'S REALLY A STRANGE FEELING SINCE I WAS PREPARING FOR COVERING THE UNEXPECTED LOSS OF THOSE GUYS AND WAITING FOR THEIR CLAIMS AND IDEAS ABOUT THIS PROJECT. BUT THE POLY TEAM TOLD ME THAT THERE WERE THOUSANDS OF PEOPLE WHO WERE STILL WORRYING ABOUT THE POTENTIAL LOSS. NOW I BECOME A REAL JOKER: DOING GOOD THINGS IN MY OWN WAY BUT BEING HUMILIATED BY THE CROWD.
I AM KIND OF CONFUSED ABOUT WHAT A MORAL LEADER SHOULD DO, PERHAPS I SHOULD NOT HAVE TAKEN IT SERIOUSLY. ANYWAY, THINGS ARE GETTING BETTER. THE REPAIRING IS SUPRISINGLY FAST. I AM MORE THAN HAPPY TO SEE THE RETURNED STABLE COINS FUNCTIONING IN THE CROSS CHAIN BRIDGE. AND I AGREE THAT THE LIQUIDITY PLAYS A KEY ROLE IN THE RECOVERING PHASE. I AM NOT READY TO PUBLISH THE FINAL KEY IN THIS WEEK THOUGH, I CAN PROVIDE ENOUGH LIQUIDITY OF WBTC & ETH TO START THE ENGINE. GETTING TIRED OF THE MESS. IT'S REALLY A WILD AND WEIRD JOURNEY.
APPENDIX:
_TBH I DID NOT RAED SOME CRITICAL MESSAGES IN TIME, SORRY_
CONVERSATION BETWEEN THE POLY AND ME:
TX 0x64eb495eba8b2000181498910748614dbd2c4bd7d6997af20cdb92c2518b2bce: "PING ME BACK IF YOU CAN HEAR ME." (MAYBE INCORRECT)
TX 0x69534e330c5f8529759272b86e90bbacf7a5c4082683064c471e5539eacf53ba: "OR LIKE THIS" (MAYBE INCORRECT)
TX 0xea4b6061c3e42c255b9cb5e78ff7ff9211b54423ff6d95c22f48df033cc011c8: "Would you please connect with us through e9g6xdbo@poly.network"
TX 0x62d376fbb95367ba95d046c0c041531e320e93526fc282da5a1a65dacc885f47: "NO EMAIL. SORRY. THE ETHEREUM MEMORIZE. I MAY OR MAY NOT PUBLISH OUR CHAT LOG. YOU CAN CHOOSE TO BE TRANSPARENT AND TO SYNC WITH THE PUBLIC."
TX 0x4d6490b47a82e548236b4448713a973d833e439ad9fff76513d38ad2f7cb4fa5: "NEXT MOVE: UNLOCK MY USDT THEN I TRANSFER IT TO YOU"
TX 0x7a924cf530150ba0d0d8b063f33a812ccf7564d347c193d03ad3b728c5fc6ab2: "we will inform Tether as soon as you return all the asset in Polygon"
TX 0x339bee245002f1c41eff7469fe51424d48d6ef856cc81e81d66135e40968f53f: "Is this mailbox yours negotiations@cock.li"
TX 0x588732ed9ec2861e6300710a9a3dcad20d8da591e7e93da3b556d351da697477: "Please confirm your email is polyhacker@yandex.com, not negotiations@cock.li, too many fake emails."
TX 0x98b6316d3004be81c5d1b06c27472bef8097c9c922345876cd36111495ccf32a: ALREADY DECRYPTED
TX 0xdef85ff964015bbb4634f414b1f52228569912657932fa7db5c3365609befb10: "SOME TIPS: AS YOU MAY ALREADY KNOW, I TRIGGERED A NATIVE CONTRACT ON ONTOLOGY WHICH CALLED CROSS CHAIN FUNCTIONS ON THE FOUR CHAINS. THE RELAYERS SHOULD IGNORE MY TRANSACTION SINCE IT'S NOT DEFINED IN THE CONFIG. THEN I NOTICED THE INVOCATION IS ALREADY RECORDED AND PROVED BY THE POLY CHAIN, SO I CAN QUERY THE LOGS AND REPLAY THEM ON THE DEST CHAINS"
TX 0x2f47a23f49ea52a21d44e41937362a55d8addcbe2dbe13f1536da2e16fc41448: "YOU GUYS SHOULD HAVE ENOUGH FUND AND CREDIT TO START THE RECOVERING PHASE. FOR THE REST OF ASSETS, I'M CONSIDERING BUILDING A MULTISIG WALLET SHARED BETWEEN US. I WILL TRANSFER THE REMAININGS TO THAT WALLET. I WILL PROVIDE THE FINAL KEY AFTER IT'S SETTLED. YOU CAN CLAIM THAT YOU HAVE COLLECTED THE ASSETS EARLY. LET THE CRYPTO TALKS. (I MAY DISCLOSE THIS MESSAGE LATER)"
TX 0x05f90618be1e7f64230618476912dccb0091f6eb011dd983f4ac7239e846d422: ALREADY DECRYPTED
TX 0x6c2bbca8ddc9b5ff6ffb1adc0000d909646321de35a4569a3d9c6087cd733f32: "we are working on solutions based on your request"
TX 0x76c8bb50b66b9c21655c2379ebd023100aec3df551dffbb8c33ee11764b10544: I MISSED THIS ONE. "We have prepared 160 ETH of bug bounty at 0x583E25dE879e90cF5fC637F8Dc16Db8F10D91C17, and we will transfer it to a designated address after receiving all the remaining assets.)
There are two options for the receiving address of user assets:
1. Transfer to the multi-sig address on Ethereum that we provided: 0x71Fb9dB587F6d47Ac8192Cd76110E05B8fd2142f. This solution is helpful for users to quickly restore control of their assets.
2. We prepare a 2-2 multi-sig address together. You will be one of the co-signers, and the other co-signer is our multi-sig address: 0x71Fb9dB587F6d47Ac8192Cd76110E05B8fd2142f. This solution requires you to sign and return the assets later.
At the same time, we expect to upgrade Poly Network and to fix the vulnerabilities tomorrow. We hope that we can receive the remaining assets today, so that Poly Network and the related projects can be resumed as soon as possible. We wish we can continue to have your assistance regarding security after this incident is resolved."
TX 0x64c237d37a39662c8386a6f4893c5852486c3d1bbc68605465c603061ddf7d13: "N FROM YOU, 2 FROM ME, MAKE A N+2/N+1 WALLET. 1 KEY WILL BE PUBLISHED, 1 KEY IS THE BACKUP. USE ADDRESSES: 0xDbfa1dC4c1F2bd322b067b8160830F478823059D AND 0x114A38E1f18504BfCc8e4cbfEfff879d2607cE62. TEST IT BEFORE USING IT."
TX 0x80606664c4cc699c76678842eb13f14ea1e1c85ada8ecf621ee210a7be545d2c: "https://gnosis-safe.io/app/#/safes/0x34D6B21D7B773225A102b382815e00Ad876E23C2/transactions, please sign it"
TX 0x8e1f8292201459f372eb1246e5fac4b0814d9a45f9fc30fd7af599fd0d09d040: "We have received all the assets and we expect to restart Poly Network as soon as possible this week. Therefore, to restore all assets according to the original ratio, we hope that you can provide us with the private key of one of the multi-sig addresses .)
We've also noticed that you disclosed that we offered a security bounty. Regarding your contribution to the Poly Network, we still hope to provide you with our bounty reward, and hope that you can send us an address. Of course, we hope to invite you to become the Chief White Hat of Poly Network in the future and contribute to the development of the blockchain world with us."
TX 0x6c4dbf770b84d97fef3a1088cfa92f1af724dabfdbd43839b82bc9bc80b7f1c4: I MISSED THIS ONE "We are discussing with Tether team about the locked USDT."
TX 0x88cc92a023105802dbd4172f451663c6d67f8990da69f0867b3f045e26e11328: "In order to ensure the safe recovery of Poly Network's systems, we expect the following work to consist of five phases:)
1. Vulnerability fix: We will complete vulnerability fix in collaboration with multiple security agencies; will start a global Bounty program and invite more security agencies and white hat organizations to participate in the security review.
2. Mainnet upgrade: After conducting audit together with multiple security audit companies, we will update the mainnet and enable the cross-chain functions as soon as possible. We will postpone the launch of other advanced functions.
3. Putting projects back online: After completing assessment by the security agencies, we will gradually restore the cross-chain services of some projects that use Poly Network.
4. Asset recovery: After receiving the authorization with your private key, we will perform asset recovery as soon as possible to make preparations for users to freely withdraw their assets.
5. Restart of all services: After all assets are fully recovered, we will fully restore all the functions of the Poly Network and will return the control of the assets to the users."
TX 0x96cf55c87fd9eddced690c4dc05dcc37247910bd8873bef52b55a977f345330d: "This is the PR to fix vulnerability, https://github.com/polynetwork/eth-contracts/pull/12/files"
TX 0xa53f6bb54b3dfa4fcca5b307a8a0b56c3a683dc6cfee5ed7415c57a5a1aff3b7: I MISSED THIS ONE "We will update the mainnet and enable the cross-chain functions tomorrow. In addition to the 160 ETH Bounty (converted from $500k at then) we previously promised, we will release a new $500k Bounty Program for global security agencies. Before that we also expect to get your comments on this Hotfix PR."
TX 0x393cec648733d3fd1448ae5620700f505c357e6b684e5bcc0d584ca3b0ede5bd: "Today the Poly Network mainnet has been relaunched, and the cross-chain transfer has been enabled for some projects . Thank you very much for your support and assistance. We have carefully reviewed your suggestions to everyone. As you mentioned yesterday, "SINCE PROTECTING THE ASSETS IS ALWAYS MY FIRST PRIORITY", we hope to restore the ability to use and make cross-chain transfers of major assets to our users as soon as possible. We would like to know in which way you plan to transfer your private key to us. This will speed up the process of giving the control of assets back to users."
SOME ENCRYPTED TEXTS (FROM A TRUE INSIDER):
TX 0x578da109df18e8bc472ea2461b4977420ef0585d3f8fec252ecb8e5d681cb0ea: "TBH I THINK THE POLY NETWORK IS A MASTERPIECE. IT'S MORE CAREFULLY DESIGNED THAN OTHER CROSS CHAIN PROJECT. HOWEVER, IT'S HARDER TO REVIEW DUE TO ITS COMPLEXITY. I TRIED TO CONVINCE THE COMMUNITY THAT IT HAD THE POTENTIAL TO BE THE MOST SUCCESSFUL CROSS CHAIN PROJECT AS IT USED TO BE, BUT I FELT THAT SOME SECURITY TEAMS WERE DOWNPLAYING THE QUALITY OF THIS PROJECT TO BOAST THEIR CAPABILITY OF QUICK POSTMORTEM. I HAVE NEVER THOUGHT OF HURTING THE DEVS WHO REALLY DEVOTED TO THEIR PROJECT, BUT I CAN NOT CONTROL THE WHOLE MEDIA. AS YOU KNOW, THE POLY CHAIN IS A NETWORK REQUIRES REGISTRATION, WHICH IS THE _CENTRALIZED_ PART WHICH I AM NOT ALLOWED ACCESS AND I CAN NOT TRUST, SO I HAD TO CONTINUE BLOWING UP THE _OBVIOUS_ PART OF THE EXPLOITATION CHAIN SO THAT THE REAL ASSETS COULD BE SAVED BEFORE ANY CAPABLE INSIDER FIGURING OUT THE POTENTIAL ATTACK VECTOR. FOR THE _CENTRALIZED_ POLY CHAIN, I THINK IT'S STILL A BIG LOOPHOLE OF A BILLION PROJECT, NO MATTER IF THE CONTRACTS ARE PERFECTLY IMPLEMENTED. YOU ARE FREE TO SHARE OR PUBLISH THIS MESSAGE. BTW I HAVE BEEN TOLD THAT THIS PROJECT IS HEAVILY USED BY ASIAN OR CHINESE DEFI USERS, BUT I DID NOT FIND MANY VOICES IN PUBLIC. DO YOU HAVE ANY SOURCES OF THE OPINIONS FROM COMMUNITY?"
TX 0x5ca0c6d1380fbbea5152ac35d6c876c5accc91d6a7d960f75ed534ed5bdfa1e5/0xb0f349dada561574d1dde4850dc42c8de4ee0fcc10d0075f6304e4b0d80122a3: NOT APPROPRIATE FOR DISCLOSURE DUE TO PRIVACY CONCERNS
TX 0x29939d068232548715cdf2f7069bd42f5146b3200bbfbef8f1e8d565786c83af: "I GOT TONS OF CHINESE COMMENTS ON MY BSC ADDERSS. SOME RANDOM STUFF IS FUN. BUT WHY ARE THEY ASSUMING HACKERS ARE BLACK PEOPLE? ISNT THAT WEIRD?"
TX 0x38ad10b88d9f1f49d91f54297d5802073e724854920c703a39ad71574827d49c: "Q: BUT WHY ARE THEY ASSUMING HACKERS ARE BLACK PEOPLE?
A: THEY ARE JUST IMAGING WHAT THEY WILL DO IF THEY CAN TAKE SUCH AMOUNT OF MONEY. IF SOMEDAY THEY HEARD A BUG OF SOME PROJECT, THEY WILL STEAL THE MONEY EVEN IF THEY NEVER KNOW HOW TO HIDE THEMSELVES.
> 1: IT'S A SERIES OF HARD QUESTIONGS. I DON'T KNOW. AND I HAVE A FEELING THAT YOU KNOW THE POLY MUCH BETTER THAN ME, WHY NOT ANSWERING IT FOR ME?
LOL FOR THIS
"