Wormhole Hacker Counter-Exploited

Last February’s hack of the Wormhole bridge was an unforgettable moment. Not just because of the massive loss (120,000 ETH, worth $325 million, the 5th largest all-time), or because of its status as one of the first major blows of the (still ongoing) bear market, but because it was amazingly instantly refilled by trading firm and Wormhole investors, Jump Crypto.

At the time, most people assumed that Jump would write off the hacked amount and eat the loss. After all, they aren’t hurting for money. How could you when you made a cool $1.28 billion on Terra?

Well, it turns out that might not be the case after all.

In a stunning turn of events, Jump has counter-exploited the Wormhole hacker for the 120,000 ETH it lost.

Wait, what??

The Wormhole Hack

Wormhole is what is known as a bridge. Basically, it is a cross-chain protocol that allows users to transfer assets between blockchains. So, if you wanted to transfer money from Solana to Ethereum, you would use a bridge like Wormhole.

These bridges work great, but they are also prime targets for hacks and exploits as they typically hold a significant amount of assets. They also are controlled by a small set of validators, making them not super secure. In other words, bridges are like cat-nip to hackers.

And we’ve seen this play out time and time again, as bridges account for 3 of the 5 biggest exploits of all time.

In Wormhole’s case, all it took was a clever hacker noticing a bug in the code. This hacker used the bug to trick Wormhole into crediting them with depositing 120,000 ETH on Ethereum, allowing them to mint the equivalent in wrapped whETH (Wormhole ETH) on Solana, which they then ran off with.

Unfortunately for the hacker, they were noticed before they could get off-chain. Because of the blockchain’s public and transparent nature, this means that their stolen ETH was “marked”. There was now no way for the hackers to get to a centralized exchange to sell the stolen funds without it being confiscated.

So, they decided to screw around on-chain instead, even buying the dip at one point.

Eventually, the hackers and their stolen ETH found their way to the lending protocol Oasis.

And this is where the counter-exploit happened.

The Counter-Exploit

The counter-exploit is a bit difficult to understand, so we’ll break it down in timeline format:

• Oasis is controlled by a 4 of 12 multi-sig. Basically, it takes 4 admin votes for anything of note to happen in the protocol.

• On February 16th, a whitehat hacker discovers a previously unknown vulnerability in the design of the admin multi-sig. The whitehat realizes this vulnerability enables a counter-exploit, and tells the Oasis team about it.

• On February 21st, the High Court of England and Wales orders Oasis to “take all necessary steps that would result in the retrieval of certain assets involved with the wallet address associated with the Wormhole Exploit”. In other words, do what needs to be done to get the money back.

• On February 22nd, in collaboration with Jump, Oasis uses the vulnerability to take the ETH out of the Wormhole exploiter’s vault and into a wallet controlled by Jump.

This is obviously a huge win for Jump, but we’re not as sure it’s a positive development for DeFi.

Two Wrongs Don’t Make A Right

DeFi was meant to be a place that is permissionless and censorship-resistant – a financial arena free from the influences of the rich and powerful.

If DeFi protocols are now removing money from people’s accounts because of court orders, as is the case with the counter-exploit, this is sadly no longer the case.

And this is a very slippery slope for DeFi to go down.

Decentralization is what makes DeFi, DeFi. Without it, DeFi is nothing more than on-chain traditional finance. The problem with this is on-chain traditional finance is not as valuable as a decentralized, permissionless, and censorship-resistant financial system. The world doesn’t need tokenized stocks. But it does need a form of money free from tyranny.

Unfortunately, it looks like this dream is slowly slipping away.