Polter Finance, a decentralized non-custodial lending and borrowing platform, has suspended its operations after a significant security breach resulted in the loss of $12 million. The incident, which occurred on November 17, prompted the protocol to involve law enforcement and notify its investors via social media.
The hack exploited a vulnerability related to price oracles during a flash loan attack on Polter’s newly launched SpookySwap market. According to TenArmor, a Web3 security firm, the attack was sophisticated and targeted the underlying technology that supports the platform’s operations. While Polter Finance has yet to confirm the specifics of the exploit, it has been reported that the stolen funds were traced back to wallets associated with the crypto exchange Binance.
In an effort to engage with the hacker, Polter Finance sent an on-chain message proposing negotiations and offering potential amnesty for returning the stolen funds. As of now, there has been no response from the perpetrator.
The pseudonymous founder of Polter Finance, known as Whichghost, took swift action by filing a police report with authorities in Singapore on the same day as the hack. The police were able to verify Whichghost’s identity using Singpass, a digital identification system for Singapore residents. The report detailed that Polter Finance lost over 16.1 million Singapore dollars (approximately $12 million) in cryptocurrency assets. This included personal losses amounting to $223,219 for Whichghost himself.
In his statement regarding the incident, Whichghost emphasized his belief that he had not shared any sensitive information such as private keys that could have led to this breach. He expressed concern that the newly deployed smart contract for lending BOO tokens had been compromised, resulting in unauthorized transactions.
Despite Polter Finance’s efforts to address the situation, skepticism grew within the community. Many users on X (formerly Twitter) speculated whether insider activity might have contributed to the breach. Critics suggested that filing a police report could serve as a distraction from internal investigations into potential vulnerabilities within their systems.
To bolster their security measures and track down the hacker, Polter Finance announced a partnership with the Security Alliance Information Sharing and Analysis Center (SEAL-ISAC). This collaboration aims to enhance their ability to investigate cyber threats and improve overall platform security in light of recent events.
Before the hack, Polter Finance had a total market size of $12 million. This comprised various assets including $7.87 million in Fantom (FTM), $1.03 million in wrapped USD Coin (USDC), $251,000 in Magic Internet Money (MIM), and $2.1 million in Stader sFTMX among others. The platform’s rapid growth was indicative of its popularity within the decentralized finance (DeFi) sector.
The BOO market, which was instrumental in facilitating the hack, had only been valued at approximately $3,000 prior to this incident. This discrepancy highlights both the volatility inherent in cryptocurrency markets and the potential risks associated with newly launched DeFi projects.
As Polter Finance navigates this challenging period, it remains uncertain how long operations will be paused or what measures will be implemented to restore user confidence. The incident serves as a stark reminder of the vulnerabilities present within DeFi platforms and underscores the importance of robust security protocols.
The community is left watching closely as developments unfold and as Polter Finance works towards recovery while addressing concerns about its infrastructure and security measures moving forward.
The hacking incident at Polter Finance is not just a significant financial loss but also raises critical questions about security practices within decentralized finance platforms. As investigations continue and partnerships are formed to enhance safety measures, stakeholders will be keenly observing how Polter Finance responds to this challenge and what steps it takes to prevent future breaches.
Read more:
