Wormhole: $320M Stolen, Then Counter-Exploited Back

On the evening of 2 February 2022, someone persuaded Wormhole that they had deposited 120,000 ether. They had deposited nothing. Wormhole, which believed them, issued 120,000 tokens that could be swapped one for one for real ether, then worth about $320 million. Within minutes most of it had been cashed out.

Wormhole is a bridge, a service that moves money between two blockchains, the separate networks on which different coins live. Think of it as a currency exchange desk at a border. A customer hands over dollars on one side, the desk locks them in its safe, and issues a voucher on the other side that can be spent locally and later swapped back. Wormhole did this between Ethereum, the second-largest crypto network, and Solana, a faster rival. The vouchers were called wrapped ether, or wETH. Every one was supposed to be backed by a real ether locked in the safe on the Ethereum side.

On 2 February 120,000 of them were backed by nothing. It was the biggest crypto theft since the $611 million Poly Network hack of August 2021, and it left a hole that threatened everyone who held wETH on Solana. If the vouchers could not be redeemed, they were worthless.

How the trick worked

Wormhole did not trust a single computer to say "a deposit has arrived". It used 19 guardians, independent companies running the network's checking software, and needed 13 of them to sign off before the Solana side would issue new vouchers. It was the digital version of a bank that will not release money until a majority of its directors countersign.

The flaw was in the clerk who checked the signatures. On the Solana side, Wormhole's code asked a standard piece of Solana's own software to confirm that the signatures had been verified. It did not check that the piece of software it was asking was the real one. The attacker built a fake that answered "yes, all verified" and handed it over. Wormhole accepted the answer, treated the attacker's message as approved by the guardians, and issued 120,000 vouchers.

The attacker sent about 93,750 of them back across the bridge and redeemed them for real ether on Ethereum, emptying most of the safe. The rest was swapped on Solana for other coins. A fix for the weak check had already been written and posted on Wormhole's public code site, but had not yet been put into the live bridge. Several security firms that later studied the attack suggested the thief may have spotted it there.

The bailout

Wormhole's team put a message on the blockchain offering the attacker $10 million, the standard "white hat" deal: give it back, keep a reward, no questions. The offer was ignored.

What happened next was unusual. Wormhole had been bought in 2021 by Jump Crypto, the digital arm of Jump Trading, a large and secretive high-speed trading firm based in Chicago. On 3 February 2022, less than a day after the theft, Jump put 120,000 of its own ether into the bridge's safe, about $320 million of its own money, so that every voucher was again backed. Wormhole was back online within about a day. Nobody who held wETH lost anything. In stock market terms, a broker's parent company quietly refilled the client account after a fraud rather than let the broker fail.

That made Jump the victim. The thief's address on Ethereum then sat largely still for almost a year.

Hacking the hacker

In January 2023 the money moved. According to the blockchain analysts at Elliptic and PeckShield, the attacker swapped about 95,600 ether, roughly $155 million, into staked ether tokens from Lido and Rocket Pool, which are receipts for ether that is earning interest, a little like a certificate of deposit. The attacker then put those receipts into vaults on Oasis.app, a website for borrowing against crypto, and took out loans in DAI, a digital dollar issued by MakerDAO. By mid-February 2023 the two vaults held about $220 million of collateral against $78 million of DAI debt. The attacker was using the stolen money to borrow more money, a leveraged bet on ether rising, like buying shares on margin.

There was a catch the attacker either missed or ignored. Oasis's software contained a back door its operators could use in an emergency to upgrade the code. On 21 February 2023, someone used it. Both vaults were taken over, the DAI debt was repaid, and about 120,695 wrapped staked ether and 3,213 Rocket Pool ether, worth about $225 million, were moved to new wallets. Blockworks Research, which first spotted the transfers, traced the receiving wallets to Jump. After repaying the loans, the net recovery was about $140 million.

Oasis confirmed three days later that it had acted on an order from the High Court of England and Wales, working with a "court-authorised third party", and said the upgrade mechanism existed to protect users. It did not name the third party. Jump did not comment.

The crypto world split. Some cheered: a thief had lost his loot by court order, which is how theft is supposed to end. Others saw a problem. Oasis had sold itself as software no operator could interfere with, and it had just shown that its operators could move a customer's funds whenever a court asked. If a London judge could order it, so could a less friendly government, or anyone who stole the emergency key.

Where it stands

The attacker has never been named, charged or publicly identified. Nothing suggests the case is linked to North Korea's hackers, who were blamed for the Ronin bridge theft weeks later. Jump got back roughly $140 million of the $320 million it paid out, so it carried a net loss of about $180 million.

Wormhole kept going. The Wormhole Foundation raised $225 million at a $2.5 billion valuation in November 2023, its managers split from Jump into an independent company, Wormhole Labs, and its token, W, was handed out free to more than 400,000 wallets in April 2024, briefly valuing the network at close to $3 billion before the price fell sharply. Bridges, meanwhile, stayed crypto's favourite target. Ronin lost $625 million in March 2022 and Nomad about $190 million that August, both through the same kind of failure: the check that is supposed to say "this deposit is real".