What happened
Portal was the token-bridge interface built on Wormhole. On February 2, 2022, an attacker exploited Wormhole’s Solana-side signature-verification path to mint 120,000 unbacked Wormhole-wrapped ETH, then bridged 93,750 wETH to Ethereum. The incident is commonly described as the Wormhole exploit; Portal is the affected bridge interface.
Missing validation of the canonical Solana Instructions sysvar account in the signature-verification flow allowed attacker-controlled instruction data to be treated as guardian-signature verification.
Case & protocol details
Attack Timeline
Wormhole’s verify_signatures path relied on a Solana instructions-sysvar helper that did not validate that the caller supplied the canonical Instructions sysvar account. The attacker supplied an account containing crafted serialized instruction data, producing a fake SignatureSet that the bridge accepted. They used it to post a forged VAA and called complete_wrapped, which minted 120,000 unbacked wETH on Solana; 93,750 wETH was then bridged to Ethereum.
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report Wormhole incident report wormholecrypto.medium.com
- transaction Transaction threadreaderapp.com
- transaction Transaction solscan.io
- analysis CertiK Wormhole exploit analysis certik.medium.com
- analysis Elliptic Wormhole incident analysis elliptic.co
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.