Hackers stole more than $320 million in cryptocurrency from DeFi platform Wormhole

The vulnerability has been fixed and funds "restored" to accounts, the company said.

A hacker stole $320 million worth of Ethereum cryptocurrency from decentralized finance platform Wormhole on Wednesday. The attack is the largest against the cryptocurrency industry so far in 2022 and one of the top hacks of the industry to date.

As of Thursday morning, all of the stolen funds were “restored,” the trading platform was back up, and an incident report was coming soon, according to tweets by the company. The vulnerability used by the attacker had been fixed, Wormhole said late Wednesday.

The platform allows users to send Ethereum and Solana cryptocurrencies across two different blockchains. A preliminary analysis of the attack by blockchain security firm CertiK shared with CyberScoop found that the hacker was able to exploit a vulnerability that allowed it to create a fake Solana transfer that it used to claim real Ethereum.

“We seem to be at an awkward point where the demand for cross-chain infrastructure is far outpacing the industry’s ability to build services securely.” Connie Lam, head of CertiK incident response team, wrote in an email to CyberScoop. Lam says that bridges are an attractive target because they operate across multiple chains and offer multiple points of failure. “Hackers follow the money, and a lot of money goes to the newest, most exciting ecosystems.”

The Wormhole hack is just the latest in a string of breaches plaguing the industry. Last week, hackers stole $80 million from DeFi exchange Qubit Finance after exploiting a bridge. In late January, centralized exchange Crypto.com reported that attackers accessed $30 million worth of cryptocurrency.

“DeFi,” or decentralized finance, is a form of peer-to-peer sharing that eliminates any middlemen from the process. However, the decentralized nature of the platforms has also left them more susceptible to attacks. Many protocols used in DeFi are open source, which means criminals have plenty of opportunities to hunt for bugs to exploit.

In 2021, hackers stole $1.3 billion in cryptocurrency across 44 DeFi incidents, according to a report by CertiK. A separate analysis by Chainalysis estimated that of the roughly $3.2 billion in cryptocurrency stolen in 2021, nearly three-quarters of the losses were from DeFi protocols.

Wormhole on Wednesday offered the hacker a bounty for sharing details about the exploit used to breach the bridge and return the money, a strategy that other hacked cryptocurrency platforms have employed in the past.

“We noticed you were able to exploit the Solana VAA verification and mint tokens,” the company wrote to the hacker. “We’d like to offer you a whitehat agreement, and present you a bug bounty of $10 million for exploit details, and returning the wETH you’ve minted.”

The company did not respond to requests for comment, so it’s unclear if it has man contact with the hacker.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure