What happened
On 2 February 2022, an attacker bypassed the Solana signature-verification path of the Wormhole bridge and minted 120,000 unbacked wrapped ETH. Wormhole normally requires a Guardian quorum before a cross-chain action can mint a wrapped asset. Here, the Solana program accepted attacker-controlled data in place of the canonical Instructions sysvar, so a forged verification path appeared valid.
The attacker redeemed 93,750 ETH through the Ethereum side of the bridge, leaving a collateral shortfall. Jump Crypto later recapitalized the bridge with 120,000 ETH; that protected users but was not a recovery from the attacker.
The Solana core bridge trusted a caller-supplied Instructions sysvar account while using deprecated load_instruction_at. Because the helper did not validate the canonical sysvar identity, attacker-crafted account data could impersonate secp256k1 verification and authorize a forged Guardian VAA.
Case & protocol details
Attack Timeline
The attacker supplied a controlled Solana account containing data shaped like a secp256k1 verification instruction. Wormhole’s core bridge used the deprecated load_instruction_at helper, which did not confirm that the supplied account was Solana’s real Instructions sysvar. The forged data therefore passed the bridge’s Guardian-signature check without a genuine quorum.
The attacker then posted the forged VAA and called the normal token-bridge completion flow to mint 120,000 wrapped ETH without a matching Ethereum deposit. They redeemed 93,750 ETH to Ethereum and converted other proceeds on Solana. The remediation replaced the unchecked instruction loading with a checked sysvar path and blacklisted the fraudulent messages.
Funds Recovery
Recovered
$326.0M
Net Loss
$0
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- report Report twitter.com
- report Report cointelegraph.com
- report Wormhole incident report wormholecrypto.medium.com
- transaction Transaction solscan.io
- analysis Web Archive web.archive.org
- analysis Ackee technical analysis of Wormhole ackee.xyz
- analysis Elliptic investigation of the Wormhole funds elliptic.co
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.