That’s a signature move: How $320m in Ether was stolen from crypto biz Wormhole
Wormhole, a protocol for connecting different blockchains, lost about $320m worth of Ether (ETH), thanks to poorly crafted code.
“The wormhole network was exploited for 120k wETH,” the DeFi biz said via Twitter on Wednesday.
“wETH” stands for “wrapped Ether,” an intermediary token used to transfer Ether across blockchains built for different cryptocurrencies. Wormhole’s technology serves as a bridge that links the Solana blockchain to various other “decentralized finance” or DeFi blockchains like Avalanche, Binance Smart Chain, Ethereum, and others.
The loss represents the fourth biggest cryptocurrency hack to date, according to British blackchain analysts Elliptic.
Those organizations behind Wormhole said they would add more ETH in the hours to come to ensure wETH is backed with ETH. And on Thursday, as if by magic, Wormhole proclaimed, “All funds have been restored and Wormhole is back up.”
But the firm used the word “restored” when “replaced” would have been more accurate. The stolen funds were not recovered from the thief; rather the looted till was refilled by benefactor Jump Crypto, which last year bought Certus One, the company that developed Wormhole.
“@JumpCryptoHQ believes in a multichain future and that @WormholeCrypto is essential infrastructure,” Jump Crypto said via Twitter. “That’s why we replaced 120k ETH to make community members whole and support Wormhole now as it continues to develop.”
Wormhole has also offered the thieves that pilfered the digicash a $10m “white hat” reward if the funds are returned. There’s no word yet of any movement on that front.
As one anonymous wag put it, “So the slot machine paid out for one lucky winner and the house covered the losses from profits made elsewhere.”
The hack appears to have been made possible by a signature verification function in Wormhole’s Solana bridge code that didn’t actually verify any signatures.
Paradigm security researcher “samczsun,” after exploring the pertinent code in a Twitter thread, summarized the attack scenario thus: “Wormhole didn’t properly validate all input accounts, which allowed the attacker to spoof guardian signatures and mint 120,000 ETH on Solana, of which they bridged 93,750 (~$250m) back to Ethereum.”
Security researcher Matthew Garrett speculates, based on the delay between the pull request with the fix and its merger into the codebase, that the attacker spotted the code change and crafted an exploit before the repairs could be rolled out.
“So what it looks like is that an obfuscated security critical change was published, someone figured out what the vulnerability was, and then exited with all the money before the fix was deployed,” Garrett said.
The Register asked Wormhole whether this is accurate but we’ve not heard back. ®
READ MORE HERE