EasyFi Loses $59 Million After Attacker Obtains Project's Mnemonic Keys

EasyFi became the first significant hack of a project built on the Polygon network (then still known as MATIC), after an attacker obtained the protocol's mnemonic keys and used them to withdraw roughly $6 million in stablecoins along with approximately $53 million worth of EASY tokens. No smart-contract vulnerability was involved.

The project's founder drew a comparison to the earlier compromise suffered by Hugh Karp of Nexus Mutual, where a compromised machine similarly resulted in the total loss of liquidity.

The circumstances raise an uncomfortable question about how such incidents should be categorized. Few would dispute that this qualifies as a hack rather than a code exploit, but more skeptical observers might reasonably reach for a harsher word: fraud. The attacker didn't need to find a bug — and by the founder's own account, reasonable security practices were supposedly in place — yet EasyFi still ended up at the top of rekt.news's leaderboard.

Despite the scale of the theft and confirmation that the attacker's wallet held 2.98 million EASY tokens, the token's price didn't collapse the way one might expect. EASY dropped only about 20% in the 24 hours following the hack, most likely because the attacker had not yet begun liquidating the stolen tokens. EASY is a fairly illiquid asset — its typical 24-hour trading volume sits around $10 million, though it spiked to roughly $43 million in the 24 hours after the incident. With the attacker now controlling around 30% of total supply, there's a limit to how much they could sell without moving the market significantly against themselves. That leaves EasyFi's team in an awkward position too: control over the network has effectively been centralized in the hands of whoever carried out the theft.

So while the attacker technically claims the top leaderboard spot, it's worth asking whether that ranking is actually earned.

According to the founder, the compromised machine "was not used for daily operations and is used solely for the purpose of official transfers." If that's accurate, it implies the machine held some form of treasury access — which raises the obvious question of why a single device or user would have that kind of authority at all, rather than the funds being secured behind a multisig or hardware wallet. If the admin key in question was protected by nothing more robust than a MetaMask hot wallet, there's little basis for sympathy: anyone entrusted with other people's funds has no excuse for skimping on security. A fuller post-mortem was expected from @AnkittGaur, who was expected to detail exactly how the breach occurred.

In the meantime, EasyFi appeared to be appealing directly to the attacker's goodwill, publishing an open letter as part of a "pre-post-mortem" statement. The letter acknowledged the sophistication of the attack, described EasyFi as an early, still-growing project on the Polygon Layer 2 network that wasn't in a financial position to personally cover all user losses, and pledged to do everything possible to make affected users whole. It asked the attacker to consider the effort invested in building the project and proposed returning the funds in exchange for a negotiated bounty — floating a clean payout of $1 million to the hacker, treated as a white-hat reward, in return for no funds recovery through legal action.

The core problem, though, goes beyond the letter's tone. Despite serving thousands of users, EasyFi appears to have relied on operational security that would be considered lax even for an individual managing personal funds. Whatever the external attacker's role in triggering this specific breach, EASY holders had effectively been exposed all along: a single admin key, unprotected by any timelock, was capable of draining the protocol's entire liquidity pool through a basic "transfer" function.

Ultimately, no explanation EasyFi offers is likely to shift responsibility away from a fairly simple failure — declining to use a multisig setup or a hardware wallet to protect funds belonging to thousands of users.