Curriculum·J301 Chains, Layer 2s, and Bridges·about 34 min
When it goes wrong
By the end of this lesson you can
- →Compare recovery outcomes across documented bridge failures and identify what determined each
- →Explain why an expected recovery rate is not a usable input to a decision
- →Compute the exit capacity available to holders of a wrapped asset under stress
- →Pre-commit the response that has to happen before you know anything is wrong
Junior · enrolled learners
This lesson opens with Poly Network, 10 August 2021.
- What happened
- An attacker exploited Poly Network's cross-chain contracts and took more than $610M in assets across Ethereum, BNB Chain and Polygon, at the time the largest theft in the sector. Over the following days the attacker, whom Poly Network publicly addressed as Mr White Hat, returned the funds, stating through transaction notes that they had never intended to keep them and had acted to expose the vulnerability. Everything came back except about $33M in USDT, which Tether had frozen and which was therefore never the attacker's to return. Poly Network subsequently offered the attacker a role as chief security advisor.
- The decision point
- This is the single most cited bridge outcome and the least representative one. Roughly 95 percent of the largest theft on record came back because the person who took it decided to give it back, which is not a property of the protocol, the chain, the code or anything a holder did. Recovery in this category is determined by discretionary choices made by other people, and citing the case where those choices went well is how the category acquires a reputation for recoverability it has not earned.
- Recorded loss
- $611,000,000
What you will be able to answer
- →What determined recovery in each documented bridge failure?
- →Why is an expected recovery rate unusable?
- →What limits your exit under stress?
- →What is the pre-committed response?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.digit.fyi/poly-network-funds-returned/
- https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022
- https://www.halborn.com/blog/post/explained-the-nomad-hack-august-2022
- https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft
Confidence high·Volatility medium·Reviewed 2026-08-06·Owner unassigned
Contested
Recovery percentages are computed against reported loss figures, which vary with valuation date and with whether frozen assets are counted as recovered. The figures are used to show the spread, which is wide under any reasonable accounting, rather than to rank the incidents precisely.
Per P10 nothing in this lesson implies that any bridge is likely to fail or that any is safe. It establishes what happens afterwards, which is a question with documented answers, and leaves the probability question where S203-04 leaves it.