Cross-chain Blockchain Bridge Wormhole Suffers $318M Exploit

Cross-chain bridge protocol Wormhole has suffered a security breach resulting in the loss of an estimated $318 million worth of assets. The incident, which took place in the hours leading up to press time, forced the service to go offline, with a Twitter message that read:

‼️ The wormhole network is down for maintenance as we look into a potential exploit.

???? We will provide updates here as soon as we have them.

???? Thank you for your patience.

— Wormhole???? (@wormholecrypto) February 2, 2022

Blockchain data identifies the culprit as an address that received 80,000 ETH (worth appr. $211 million) from the Wormhole Token Bridge. The said address is currently in possession of roughly $250 million worth of ETH. Notably, the transactions leading up to the attack were the first executed by the address.

Wormhole Offers $10M Bounty to Hacker

Following the hack, the Wormhole team quickly opened negotiations with the hacker through an on-chain transaction.

News of the hack is especially concerning for the Solana DeFi community since it implies that ETH assets bridged to the network may no longer be backed.

In other words, users are simply holding IOUs and will no longer be able to get ETH in return if they choose to bridge back assets to the Ethereum network. It is not surprising then that Solana-based lending protocol Solend has responded to the attack by pausing deposits and withdrawals of Wormhole-bridged assets until the issues are resolved.

In a more recent update, Wormhole has confirmed the total amount of stolen assets to be 120,000 WETH (appr. $318 million). However, the project is swiftly responding by adding ETH to the bridge to ensure that assets bridged to Solana maintain a 1:1 backing.

The wormhole network was exploited for 120k wETH.

ETH will be added over the next hours to ensure wETH is backed 1:1. More details to come shortly.

We are working to get the network back up quickly. Thanks for your patience.

— Wormhole???? (@wormholecrypto) February 2, 2022

Update: This article has been updated to include the total amount of stolen assets as confirmed by Wormhole and the latest update that ETH will be added to the protocol to maintain the status of bridged ETH assets.

More to follow…