{"id":72964,"date":"2023-01-24T12:04:12","date_gmt":"2023-01-24T10:04:12","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=72964"},"modified":"2025-09-09T11:26:10","modified_gmt":"2025-09-09T08:26:10","slug":"wormhole-protocol-hack-hacker-moved-assets-worth-157-million","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/wormhole-protocol-hack-hacker-moved-assets-worth-157-million\/","title":{"rendered":"Wormhole protocol hack: hacker moved assets worth $157 million"},"content":{"rendered":"<p>An unknown hacker who breached Wormhole, the cross-chain protocol, in February 2022 for <a href=\"https:\/\/u1f987.com\/en\/news\/hackers-drain-more-than-319-million-from-wormhole-cross-chain-bridge-pool\">over $319 million<\/a> has begun moving the assets.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">Wormhole exploiter has converted his ETH to wstETH and is going to borrow DAI against it it seems. <a href=\"https:\/\/t.co\/9rhERSMG5u\">pic.twitter.com\/9rhERSMG5u<\/a><\/p>\n<p>\u2014 Spreek (@spreekaway) <a href=\"https:\/\/twitter.com\/spreekaway\/status\/1617608174135312385?ref_src=twsrc%5Etfw\">January 23, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Twitter user under the handle Spreek noted that the hacker swapped through the <span data-descr=\"decentralized exchange\" class=\"old_tooltip\">DEX<\/span>-aggregator OpenOcean 95,677 ETH for <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-a-wrapped-token\">&#8216;wrapped version&#8217;<\/a> stETH from the <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-lido\">Lido<\/a> protocol.<\/p>\n<p>Then he moved the assets into wstETH-compatible tokens on DeFi trading platforms. He used the funds as collateral to borrow several amounts in the stablecoin DAI on the <a href=\"https:\/\/u1f987.com\/en\/news\/what-are-makerdao-mkr-and-the-dai-stablecoin\">MakerDAO<\/a> platform. Some of the coins were converted back into ETH via KyberNetwork.<\/p>\n<p>The hacker&#8217;s activity affected the stETH price \u2014 at times they exceeded the price of the underlying asset, according to <a href=\"https:\/\/dune.com\/mtgypes\/stetheth\">Dune Analytics<\/a>.<\/p>\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/V7Cv9Jb8KaNlW40Xw2irN7w0aen0mxjK0ZficX_sEqtIy4SI_Zm5fTdY_sz3jl5mOD83sc_NPh1yjVVFlEKepULTuL55OSG0Zkc4MwRxHRitoAmcyld15k7Ajf5gW83JHeA8LRwOytI1ZvIAPPEXZLvX9Qvo_eG-EFGvr2MfIfhKjZMmuaGst9x6bXV5BQ\" alt=\"Wormhole hacker who breached transferred assets worth $157 million\"\/><figcaption>Data: Dune Analytics.<\/figcaption><\/figure>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;Either the guy is simply playing on-chain with stolen assets, or he has a long position in stETH, so he decided to start trading,&#8221; commented Steven Shen, <a href=\"https:\/\/www.theblock.co\/post\/204855\/wormhole-exploiter-converts-150-million-in-eth-to-staked-assets-and-levers-up\">The Block<\/a>&#8216;s Director of Research.<\/p>\n<\/blockquote>\n<p>A similar hypothesis was voiced by Adam Cochran, a partner at venture firm Cinneamhain Ventures.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">I always watch these loop ones carefully when its from a hack.<\/p>\n<p>I suspect some of them cash out by going super leverage on a protocol while shorting on another account, let the hacked funds get liquidated in order to cash out on the clean short account.<\/p>\n<p>\u2014 Adam Cochran (adamscochran.eth) (@adamscochran) <a href=\"https:\/\/twitter.com\/adamscochran\/status\/1617612224004259841?ref_src=twsrc%5Etfw\">January 23, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;I suspect that some of them [hackers] cash out by using highly leveraged positions, while shorting through another account. This allows the hacked funds to be liquidated and withdrawn through the clean short account,&#8221; he noted.<\/p>\n<\/blockquote>\n<p>The Wormhole team has again approached the hacker with an offer to return all stolen funds for a legal reward of <a href=\"https:\/\/u1f987.com\/en\/news\/report-crypto-industry-losses-from-hacks-in-2022-rise-to-3-6-billion\">$10 million<\/a>.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">shooters shoot <a href=\"https:\/\/t.co\/WxLQeNv8KG\">pic.twitter.com\/WxLQeNv8KG<\/a><\/p>\n<p>\u2014 Spreek (@spreekaway) <a href=\"https:\/\/twitter.com\/spreekaway\/status\/1617627173355151361?ref_src=twsrc%5Etfw\">January 23, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As reported, the Wormhole incident was among the largest by damage in 2022, and industry-wide losses from attacks amounted to about <a href=\"https:\/\/u1f987.com\/en\/news\/report-crypto-industry-losses-from-hacks-in-2022-rise-to-3-6-billion\">$3.6 billion<\/a>.<\/p>\n<p>Read ForkLog&#8217;s Bitcoin news on our <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener\">Telegram<\/a> \u2014 crypto news, prices and analytics.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An unknown hacker who breached the Wormhole cross-chain protocol in February 2022 for {{AOPEN_1}}over $319 million{{ACLOSE_1}} has begun moving the assets.<\/p>\n","protected":false},"author":1,"featured_media":72965,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154],"class_list":["post-72964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes"],"aioseo_notices":[],"amp_enabled":true,"views":"17","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/72964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=72964"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/72964\/revisions"}],"predecessor-version":[{"id":72966,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/72964\/revisions\/72966"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/72965"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=72964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=72964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=72964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}