Wormhole Hack

Reported loss $326M
Solana Ethereum
Cross-chain bridge authentication bypass

What happened

On 2 February 2022, an attacker bypassed the Solana signature-verification path of the Wormhole bridge and minted 120,000 unbacked wrapped ETH. Wormhole normally requires a Guardian quorum before a cross-chain action can mint a wrapped asset. Here, the Solana program accepted attacker-controlled data in place of the canonical Instructions sysvar, so a forged verification path appeared valid.

The attacker redeemed 93,750 ETH through the Ethereum side of the bridge, leaving a collateral shortfall. Jump Crypto later recapitalized the bridge with 120,000 ETH; that protected users but was not a recovery from the attacker.

Technical root cause

The Solana core bridge trusted a caller-supplied Instructions sysvar account while using deprecated load_instruction_at. Because the helper did not validate the canonical sysvar identity, attacker-crafted account data could impersonate secp256k1 verification and authorize a forged Guardian VAA.

How it happened

  1. The attacker supplied a controlled Solana account containing data shaped like a secp256k1 verification instruction.
  2. Wormhole’s core bridge used the deprecated load_instruction_at helper, which did not confirm that the supplied account was Solana’s real Instructions sysvar.
  3. The forged data therefore passed the bridge’s Guardian-signature check without a genuine quorum.
  4. The attacker then posted the forged VAA and called the normal token-bridge completion flow to mint 120,000 wrapped ETH without a matching Ethereum deposit.
  5. They redeemed 93,750 ETH to Ethereum and converted other proceeds on Solana.
  6. The remediation replaced the unchecked instruction loading with a checked sysvar path and blacklisted the fraudulent messages.

Protocol details

Classification Bridge / Access Control
Protocol Type Bridge
Category Bridge Hack
Implementation language Rust
Protocol links Website @wormholecrypto
Attacker Address 0x629e7da20197a5429d30da36e77d06cdf796b71a
Exploit Transaction 25Zu1L2Q9uk998d5GMnX…PdL3Jo4wVS

Funds Recovery

100.0%

Recovered

$326.0M

Net Loss

$0

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Cross-Chain Bridge Attacks Signature Verification Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes