Unlock Protocol Hack

The attackers' addresses:

https://polygonscan.com/address/0xcc06dd34…5b2165

https://polygonscan.com/address/0x8c769a59…c4daac

The private key of Unlock Founder & CEO was compromised. This key had been used to deploy the Unlock contract on xDAI and Polygon previously and was able to upgrade them.

Ownership was transferred at:

xDAI:

https://blockscout.com/xdai/mainnet/tx/0x12f0a54b…08bda8

Polygon:

https://polygonscan.com/tx/0xe3b852c9…14a1a3

xDAI:

1. 20,000 Tokens were stolen from Unlock contract:

https://blockscout.com/xdai/mainnet/tx/0x6e9cbe95…a13904

2. Out of the 20,000 tokens that were stolen, 19,980 UDT were transferred by the attacker to the xDAI bridge:

https://blockscout.com/xdai/mainnet/tx/0x9241dcbf…724448

3. Tokens were burnt on xDAI, transferred on Ethereum, and sold on Uniswap:

https://etherscan.io/tx/0x966c9cda…9efd54

Polygon:

1. 30,000 tokens were stolen from the Unlock contract:

https://polygonscan.com/tx/0x91a74c7b…bbd5a4

2. 10,000 UDT were transferred to the Polygon Bridge:

https://polygonscan.com/tx/0xc5527097…5cb6b6

3. The attacker transferred another 20,000 tokens, the token recipient then transferred them to the Polygon Bridge:

https://polygonscan.com/tx/0x687e7742…f91fe1