Attribution: tying an address to an actor

Graduate · enrolled learners

This lesson opens with Poly Network, August 2021.

What happened

In August 2021 an attacker exploited a cross-chain flaw in Poly Network and took more than 610 million dollars across three chains, the largest DeFi theft to that point. What happened next was unusual: the attacker embedded messages in on-chain transactions, said they had done it to expose the vulnerability, and returned the funds over the following two weeks, apart from 33 million USDT that Tether froze, until Poly Network said on 24 August that all user assets had been recovered; Poly Network called the attacker Mr. White Hat. The chain showed exactly what the attacker's addresses did, in complete detail. Who the attacker was is a different question. The security firm SlowMist reported that through on-chain and off-chain tracking it had obtained the attacker's email, IP address and device fingerprints, traces that pointed toward an identity, but no full, confirmed public identification was ever established. The case is a clean split: the on-chain actions were known at total certainty, and the real-world identity behind them rested on off-chain leaks and remained, publicly, uncertain.

The decision point

Attribution is two claims that people constantly merge, and keeping them apart is the second discipline of the report. The chain shows what an address did with near-total certainty, and it almost never shows who controls that address. Bridging from one to the other, from a cluster of on-chain behavior to a named person, requires off-chain evidence, an exchange deposit tied to a verified identity, an IP, a reused handle, a leak, and the strength of an attribution is the strength of that bridge, not of the on-chain trail. Poly Network is the illustration: the on-chain conduct was perfectly known, and the identity rested on off-chain clues that pointed somewhere without publicly confirming it. So an analyst attributes in degrees, this address did X at near-certainty, this cluster is one entity at high confidence, this entity is person Y at whatever confidence the off-chain bridge supports, and states the residual uncertainty rather than letting the certainty of the on-chain half leak onto the identity.

Recorded loss

$611,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.