{"id":213975,"date":"2022-02-03T13:00:42","date_gmt":"2022-02-03T13:00:42","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=213975"},"modified":"2022-02-03T12:37:05","modified_gmt":"2022-02-03T12:37:05","slug":"breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/","title":{"rendered":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">One of the worst <\/span><a href=\"https:\/\/cryptoslate.com\/solanas-wormhole-bridge-gets-hacked-for-80k-eth\/\"><span style=\"font-weight: 400;\">hacks<\/span><\/a><span style=\"font-weight: 400;\"> against the Solana blockchain happened on Wednesday when a hacker managed to transfer 80,000 ether (ETH), over $214 million at the moment of writing, out of the Solana system and into the Ethereum blockchain through the Wormhole bridge \u2013 a service providing the ability to transfer funds between the different blockchains.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Explained in a tweet <\/span><a href=\"https:\/\/twitter.com\/kelvinfichter\/status\/1489041221947375616\"><span style=\"font-weight: 400;\">thread<\/span><\/a><span style=\"font-weight: 400;\"> by the pseudonymous Twitter profile <\/span><a href=\"https:\/\/twitter.com\/kelvinfichter\"><span style=\"font-weight: 400;\">smartcontracts<\/span><\/a><span style=\"font-weight: 400;\">, the hacker finalized the exploit by transferring the 80,000 ETH out of the Wormhole smart contract on Ethereum in a single <\/span><a href=\"https:\/\/etherscan.io\/tx\/0x24c7d855a0a931561e412d809e2596c3fd861cc7385566fd1cb528f9e93e5f14\"><span style=\"font-weight: 400;\">transaction<\/span><\/a><span style=\"font-weight: 400;\">. As it turned out, this was just the final move in a series of hacks that enabled the hacker to steal the funds.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u201cAlthough it's dramatic, this transaction is just the very end of an interesting series of events. I had to start working my way backward to figure out how this was even possible,\u201d smartcontracts tweets.<\/span><\/p>\n<h2><strong>Guardians signed off a false transfer<\/strong><\/h2>\n<p><span style=\"font-weight: 400;\">Wormhole is a so-called bridge, a <\/span><a href=\"https:\/\/cryptoslate.com\/companies\/smartcontract\/\"><span style=\"font-weight: 400;\">smart contract<\/span><\/a><span style=\"font-weight: 400;\">, on Ethereum in this case, that provides a way to move crypto assets between different blockchains. According to smartcontracts, from a high-level viewpoint, Wormhole specifically has a set of co-called guardians that sign off on transfers between the blockchains.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Wormhole guardians had somehow signed off on this 80,000 ETH transfer as if it was 100% legitimate.<\/span><\/p>\n<blockquote><p><span style=\"font-weight: 400;\">\u201cThe transaction that pulled out 80,000 <\/span><a href=\"https:\/\/cryptoslate.com\/news\/ethereum\/\"><span style=\"font-weight: 400;\">ETH<\/span><\/a><span style=\"font-weight: 400;\"> was actually the attacker transferring 80,000 ETH from Solana to Ethereum. I originally thought that the contract might have incorrectly validated the signatures on the transfer, but the signatures [were] completely checked out.\u201d<\/span><\/p><\/blockquote>\n<p><span style=\"font-weight: 400;\">According to smartcontracts, the first breakthrough and partial explanation came from a <\/span><a href=\"https:\/\/solscan.io\/tx\/2zCz2GgSoSS68eNJENWrYB48dMM1zmH8SZkgYneVDv2G4gRsVfwu5rNXtK5BKFxn7fSqX9BvrBc1rdPAeBEcD6Es\"><span style=\"font-weight: 400;\">transaction<\/span><\/a><span style=\"font-weight: 400;\"> on Solana which somehow minted 120,000 &#8220;Wormhole ETH&#8221;, wrapped ether on Solana, out of nowhere. Since the hacker was able to mint Wormhole ETH on Solana, he was able to correctly withdraw it back to Ethereum.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">\u201cSolana is kinda weird\u201d<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Examining the hacker's transaction history, there\u2019s a transaction that came right before the minting of the 120,000 Wormhole ETH. In this <\/span><a href=\"https:\/\/solscan.io\/tx\/3HRKFcGjVVtf1kTHWXqJmG6zimbNeQAgN5xbt3MjP3ewYB1ih1WuWjMU6EWQXAz8shD46A3uyYW9pahoARrBmmPu\"><span style=\"font-weight: 400;\">transaction<\/span><\/a><span style=\"font-weight: 400;\">, the hacker mints only 0.1 Wormhole ETH, as if the hacker was testing the function with a small amount.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A further examination of the hacker's transaction history reveals that the hacker did make a <\/span><a href=\"https:\/\/etherscan.io\/tx\/0xf54d9d84e3c8a63cd007cd52d42eedbb7be34a64f7c088086071f1e2929e1521\"><span style=\"font-weight: 400;\">deposit<\/span><\/a><span style=\"font-weight: 400;\"> of 0.1 ETH from Ethereum into <\/span><a href=\"https:\/\/cryptoslate.com\/companies\/solana\/\"><span style=\"font-weight: 400;\">Solana<\/span><\/a><span style=\"font-weight: 400;\">. Though the attacker did not make an ETH deposit of 120,000 ETH into the Wormhole smart contract on Ethereum, there's something interesting about this deposit.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As smartcontract explains in his tweet, the transactions that minted Wormhole ETH on Solana were triggering a Wormhole smart contract <\/span><span style=\"font-weight: 400;\">function<\/span><span style=\"font-weight: 400;\"> called &#8220;<a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/8d15138d5754b5e1202ff8581012debef25f7640\/solana\/modules\/token_bridge\/program\/src\/instructions.rs#L152\">complete_wrapped<\/a>&#8220;. One of the parameters that this function takes is a &#8220;transfer message&#8221;, basically a <\/span><a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/8d15138d5754b5e1202ff8581012debef25f7640\/solana\/modules\/token_bridge\/program\/src\/instructions.rs#L190\"><span style=\"font-weight: 400;\">message<\/span><\/a><span style=\"font-weight: 400;\"> signed by the guardians of the bridge that says which token to mint and how much.<\/span><\/p>\n<blockquote><p><span style=\"font-weight: 400;\">\u201cSolana is kinda weird, so these parameters are actually smart contracts themselves. But the important thing is how these &#8220;transfer message&#8221; contracts get created. Here's the <\/span><a href=\"https:\/\/solscan.io\/tx\/5fKWY7XyW6PTzjviTDvCTpsqgfoGAAqUs1mC6w4DZm25Ppw7fX7aWDmrnkknewyZ81qMSix3c18ZuvjoZUF34tpa\"><span style=\"font-weight: 400;\">transaction<\/span><\/a><span style=\"font-weight: 400;\"> that made the 0.1 ETH transfer message,\u201d smartcontracts tweets.<\/span><\/p><\/blockquote>\n<h2><strong>Who\u2019s checking the checkers?<\/strong><\/h2>\n<p><span style=\"font-weight: 400;\">This &#8220;transfer message&#8221; contract is created by triggering a <\/span><span style=\"font-weight: 400;\">function<\/span><span style=\"font-weight: 400;\"> called &#8220;<a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/9a4af890e3e2d4729fe70e43aaced39ba8b33e35\/solana\/bridge\/program\/src\/instructions.rs#L162\">post_vaa<\/a>&#8220;. The most important thing is that post_vaa checks if the message is valid by checking the signatures from the guardians. That part seems reasonable enough, smartcontracts says, but it's this signature checking step that broke everything.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The &#8220;post_vaa&#8221; function doesn't actually check the signatures. Instead, in typical Solana fashion, there's another smart contract that gets created by calling the &#8220;<a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/91296e67722032debf04e95c71b3d701d4625c5b\/solana\/bridge\/program\/src\/instructions.rs#L132\">verify_signatures<\/a>&#8221; <\/span><span style=\"font-weight: 400;\">function<\/span><span style=\"font-weight: 400;\">. One of the <\/span><a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/91296e67722032debf04e95c71b3d701d4625c5b\/solana\/bridge\/program\/src\/instructions.rs#L155\"><span style=\"font-weight: 400;\">inputs<\/span><\/a><span style=\"font-weight: 400;\"> to the &#8220;verify_signatures&#8221; function is a Solana built-in &#8220;system&#8221; program which contains various utilities the contract can use.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Within &#8220;verify_signatures&#8221;, the Wormhole program attempts to check that the execution that happened right before this function was triggered, was that the <\/span><a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/ca509f2d73c0780e8516ffdfcaf90b38ab6db203\/solana\/bridge\/program\/src\/api\/verify_signature.rs#L108\"><span style=\"font-weight: 400;\">Secp256k1<\/span><\/a><span style=\"font-weight: 400;\"> signature verification function was executed.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u201cThis verification function is a built-in tool that's supposed to verify that the given signatures are correct. So the signature verification has been outsourced to this program. But here's where the bug comes in,\u201d smartcontracts tweets.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Wormhole contracts used the function <\/span><a href=\"https:\/\/github.com\/solana-labs\/solana\/blob\/7ba57e7a7c87fca96917a773ed944270178368c9\/sdk\/program\/src\/sysvar\/instructions.rs#L180-L188\"><span style=\"font-weight: 400;\">load_instruction_at<\/span><\/a><span style=\"font-weight: 400;\"> to check that the Secp256k1 function was called first, but the load_instruction_at function was deprecated relatively recently because it <\/span><i><span style=\"font-weight: 400;\">does not check that it's executing against the actual system address<\/span><\/i><span style=\"font-weight: 400;\">!<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Game over<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">According to smartcontracts, the caller is supposed to provide as <\/span><a href=\"https:\/\/github.com\/certusone\/wormhole\/blob\/9a4af890e3e2d4729fe70e43aaced39ba8b33e35\/solana\/bridge\/program\/src\/instructions.rs#L153\"><span style=\"font-weight: 400;\">input<\/span><\/a><span style=\"font-weight: 400;\"> the system address to the program being executed, but the hacker provided a different system address.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Here's that system address being used as the input for the &#8220;verify_signatures&#8221; for the legitimate deposit of 0.1 ETH:<\/span><\/p>\n<figure id=\"attachment_213977\" aria-describedby=\"caption-attachment-213977\" style=\"width: 609px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-213977 \" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack1.jpeg\" alt=\"Correct system address input\" width=\"609\" height=\"339\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack1.jpeg 1046w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack1-300x167.jpeg 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack1-1024x571.jpeg 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack1-768x428.jpeg 768w\" sizes=\"(max-width: 609px) 100vw, 609px\" \/><figcaption id=\"caption-attachment-213977\" class=\"wp-caption-text\">Correct system address input<\/figcaption><\/figure>\n<p><span style=\"font-weight: 400;\">But here's the &#8220;verify_signatures&#8221; transaction for the fake deposit of 120k ETH:<\/span><\/p>\n<figure id=\"attachment_213976\" aria-describedby=\"caption-attachment-213976\" style=\"width: 608px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-213976 \" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack2.jpeg\" alt=\"System address input\" width=\"608\" height=\"331\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack2.jpeg 1075w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack2-300x163.jpeg 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack2-1024x557.jpeg 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana_hack2-768x418.jpeg 768w\" sizes=\"(max-width: 608px) 100vw, 608px\" \/><figcaption id=\"caption-attachment-213976\" class=\"wp-caption-text\">False system address input\u00a0<\/figcaption><\/figure>\n<p><span style=\"font-weight: 400;\">That's not the system address!<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u201cUsing this &#8220;fake&#8221; system program, the attacker could effectively lie about the fact that the signature check program was executed. The signatures weren't being checked at all!,\u201d smartcontracts tweets.<\/span><\/p>\n<blockquote><p><span style=\"font-weight: 400;\">\u201cAfter that point, it was game over. The attacker made it look like the guardians had signed off on a 120k deposit into Wormhole on Solana, even though they hadn't. All the attacker needed to do now was to make their &#8220;play&#8221; money real by withdrawing it back to Ethereum. And one withdrawal of 80k ETH + 10k ETH later (everything in the bridge on Ethereum), everything was gone.\u201d<\/span><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>One of the worst hacks against the Solana blockchain happened on Wednesday when a hacker managed to transfer 80,000 ether (ETH), over $214 million at the moment of writing, out of the Solana system and into the Ethereum blockchain through the Wormhole bridge \u2013 a service providing the ability to transfer funds between the different [&hellip;]<\/p>\n","protected":false},"author":962,"featured_media":213979,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120,76799,16041],"tags":[77258,72190,76679,75380,77330],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge\" \/>\n<meta property=\"og:description\" content=\"One of the worst hacks against the Solana blockchain happened on Wednesday when a hacker managed to transfer 80,000 ether (ETH), over $214 million at the moment of writing, out of the Solana system and into the Ethereum blockchain through the Wormhole bridge \u2013 a service providing the ability to transfer funds between the different [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-03T13:00:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-03T12:37:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana-wormhole-hack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Laszlo Dobos\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Laszlo Dobos\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/#person\",\"name\":\"Laszlo Dobos\",\"url\":\"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-300x300.jpg\",\"caption\":\"Laszlo Dobos\"},\"jobTitle\":\"Reporter\",\"description\":\"Educated in computer engineering, Laszlo began developing an interest for crypto and blockchain technology back in 2013. Lars started writing about IT and IT...\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/larsdobos\",\"https:\/\/www.linkedin.com\/in\/lars-dobos-26356a3\"]},\"headline\":\"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge\",\"datePublished\":\"2022-02-03T13:00:42+00:00\",\"dateModified\":\"2022-02-03T13:00:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\"},\"wordCount\":903,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"cross-chain bridge\",\"ethereum\",\"Hack\",\"Solana\",\"Wormhole\"],\"articleSection\":[\"Analysis\",\"Crime\",\"Hacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#respond\"]}],\"copyrightYear\":\"2022\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\",\"url\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\",\"name\":\"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2022-02-03T13:00:42+00:00\",\"dateModified\":\"2022-02-03T13:00:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/cryptoslate.substack.com\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/advertising\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/dda2470a7ceed819679f90d50a7d3055\",\"name\":\"Laszlo Dobos\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-150x150.jpg\",\"caption\":\"Laszlo Dobos\"},\"description\":\"Educated in computer engineering, Laszlo began developing an interest for crypto and blockchain technology back in 2013. Lars started writing about IT and IT-security as a full-time tech journalist and editor in 2007. He's a self-employed entrepreneur and writer deep down the famous rabbit hole. When he's not spending too much time in the crypto space or reading history books, Lars enjoys the outdoors, food and hanging out with friends.\",\"url\":\"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/","og_locale":"en_US","og_type":"article","og_title":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge","og_description":"One of the worst hacks against the Solana blockchain happened on Wednesday when a hacker managed to transfer 80,000 ether (ETH), over $214 million at the moment of writing, out of the Solana system and into the Ethereum blockchain through the Wormhole bridge \u2013 a service providing the ability to transfer funds between the different [&hellip;]","og_url":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/","og_site_name":"CryptoSlate","article_published_time":"2022-02-03T13:00:42+00:00","article_modified_time":"2022-02-03T12:37:05+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/02\/solana-wormhole-hack.jpg","type":"image\/jpeg"}],"author":"Laszlo Dobos","twitter_card":"summary_large_image","twitter_creator":"@cryptoslate","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Laszlo Dobos","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/#person","name":"Laszlo Dobos","url":"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-300x300.jpg","caption":"Laszlo Dobos"},"jobTitle":"Reporter","description":"Educated in computer engineering, Laszlo began developing an interest for crypto and blockchain technology back in 2013. Lars started writing about IT and IT...","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/larsdobos","https:\/\/www.linkedin.com\/in\/lars-dobos-26356a3"]},"headline":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge","datePublished":"2022-02-03T13:00:42+00:00","dateModified":"2022-02-03T13:00:42+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/"},"wordCount":903,"commentCount":0,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["cross-chain bridge","ethereum","Hack","Solana","Wormhole"],"articleSection":["Analysis","Crime","Hacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#respond"]}],"copyrightYear":"2022","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/","url":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/","name":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2022-02-03T13:00:42+00:00","dateModified":"2022-02-03T13:00:42+00:00","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/breakdown-how-the-hacker-stole-80k-eth-from-the-solana-wormhole-bridge\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Breakdown: How the hacker stole 80k ETH from the Solana Wormhole bridge"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/cryptoslate.substack.com","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/advertising\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/dda2470a7ceed819679f90d50a7d3055","name":"Laszlo Dobos","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2021\/12\/lars-dobos-author-150x150.jpg","caption":"Laszlo Dobos"},"description":"Educated in computer engineering, Laszlo began developing an interest for crypto and blockchain technology back in 2013. Lars started writing about IT and IT-security as a full-time tech journalist and editor in 2007. He's a self-employed entrepreneur and writer deep down the famous rabbit hole. When he's not spending too much time in the crypto space or reading history books, Lars enjoys the outdoors, food and hanging out with friends.","url":"https:\/\/cryptoslate.com\/author\/laszlo-dobos\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/213975"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/962"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=213975"}],"version-history":[{"count":8,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/213975\/revisions"}],"predecessor-version":[{"id":213996,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/213975\/revisions\/213996"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/213979"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=213975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=213975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=213975"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=213975"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=213975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}