Wormhole suffers massive heist attack
The crypto market has been known to be volatile and with everything being based on digital blockchains the chance for a hack is always on the minds of each and every developer. Security is of the utmost priority when it comes to creating a blockchain or projects on it, so a hack that results in the loss of a massive amount is always a sign that perhaps DeFi is not where it should be with how it handles security.
Recently Wormhole- a DeFi project created to create a communication bridge between Solana and various other DeFi blockchain networks , suffered a major loss when it was hacked and thieves made away with 120,000 wETH.
The wormhole network was exploited for 120k wETH.
— WormholeđȘ (@wormholecrypto) February 2, 2022
ETH will be added over the next hours to ensure wETH is backed 1:1. More details to come shortly.
We are working to get the network back up quickly. Thanks for your patience.
Â
This amount of wETH comes out to be about $320 Million U.S Dollars in cryptocurrency, yet again showing the volatility of the digital assets ecosystem. Tom Robinson, a co-founder of Elliptic a blockchain analysis firm blamed the transparency of the blockchain for allowing the attackers to identify and exploit major bugs.(bloomberg.com, 2022). This is most likely one of the greatest hacks on a DeFi protocol to date and the amount lost by Wormhole is indeed staggering.
At this point the team at wormhole has pledged to replace the lost wETH 1:1 but a reward of $10 Million has been offered to the hackers if they return the rest of the money and explain the bug but at this moment there is no reply. The bug itself seems to have been discovered and explained via a detailed thread on twitter
Â
How did the @wormholecrypto exploit work? I joined forces with @gf_256 and @ret2jazzy to reverse engineer the exploit, and now that it's been patched we can finally share it with youđ pic.twitter.com/lXwD0GLZ3N
— samczsun (@samczsun) February 3, 2022
It would seem there was a rather lengthy setup that in the end exploited the bridging system created by wormhole. The transaction was created on Solana that âbridged out the ETHâ. The main issue was sussed out by samczsun and their team and explained thoroughly in this twitter thread.
The `verify_signatures` function is meant to take a set of signatures provided by the guardians and pack it into a `SignatureSet`. But it doesn't actually do any of the verification itself. Instead, it delegates that to the Secp256k1 program. pic.twitter.com/0Fg3GCgCmh
— samczsun (@samczsun) February 3, 2022
Â
After the attack the price of Solana took another drop after rallying back up to above $100. The issues on the Solana chain continue to mount up and show how Solana needs to create new ways to counteract all of the negative transactions and projects that the new blockchain is being subjected to. This attack is yet another reality check in the volatility and vulnerability of DeFi as a whole. Solanews has reached out to Wormhole and has yet to receive an answer but will update as soon as possible.