Résumé
On 2 February 2022, an attacker exploited the Wormhole bridge connecting Solana and Ethereum and minted about $326 million of wrapped Ether out of thin air, one of the largest DeFi hacks ever. Unlike the Ronin theft weeks later, this was a pure code bug, not a stolen key. Wormhole's Solana contract failed to properly verify the signatures that are supposed to prove a deposit really happened, so the attacker forged a deposit that never existed and told the bridge to release 120,000 ETH against it. The bridge's backer, Jump Crypto, replaced the entire $326 million the next day to keep it solvent. It is the textbook example of a [cross-chain bridge](/glossary#bridge) undone by a single missing validation check.
How it happened
A bridge like Wormhole works by locking an asset on one chain and minting a matching "wrapped" token on the other, with a set of trusted signers (Wormhole calls them guardians) attesting that the deposit is real. To mint wrapped ETH on Solana, Wormhole's contract had to confirm those guardian signatures had genuinely been verified.
The flaw was in how it confirmed that. On Solana, the program checked that the signature-verification step had run by reading a special system account (the Instructions "sysvar"), but it accepted that account as one supplied by the caller and never checked that the account's address was actually the real sysvar. The attacker simply handed it a spoofed account crafted to look like a successful verification of fabricated guardian signatures. The contract believed it, accepted a forged proof-of-deposit, and minted 120,000 wrapped ETH backed by nothing, then bridged roughly 93,750 of it back to Ethereum, draining real Ether from the reserves that backed everyone else's wrapped tokens. The fix was a single added line: reject any instruction account whose address does not match the genuine sysvar.
The aftermath
Wormhole was developed by Certus One, owned by the trading giant Jump Crypto, and Jump made the unusual decision to replace all 120,000 ETH (about $326 million) within a day to keep the bridge solvent and wrapped-asset holders whole; an on-chain message offering the attacker a $10 million whitehat bounty went unanswered. About $225 million was recovered a year later: on a February 2023 order from the High Court of England and Wales, Jump Crypto counter-exploited a flaw in Oasis, the MakerDAO front-end where the attacker had parked the funds in automated vaults, to seize them back. One uncomfortable detail: the fix had been merged to Wormhole's public code repository about 53 minutes before the attack but not yet deployed to the live network, so a public, undeployed security patch may have served as the attacker's roadmap.
Why Wormhole still matters
Wormhole reinforces that bridges are the richest honeypots in crypto and that the bug is rarely exotic, here it was forgetting to check that an account was who it claimed to be. It also teaches the deploy-gap lesson: a security fix sitting in a public repo before it reaches mainnet is an open invitation. The durable defences are specific to this class of code: validate every account and sysvar against its canonical id before trusting it, never rely on an account's position in the list, use checked loaders and declarative constraints (such as Anchor's address constraints) that fail closed, and push security patches to mainnet the moment they merge. It is a sibling of the Ronin hack, the other nine-figure bridge theft of 2022.
Comment le corriger
- Deploy the address-validation fix to mainnet immediately and pause minting until every guardian-signature path verifies the genuine sysvar.
- Restore solvency transparently (Wormhole was backstopped within a day) so wrapped-asset holders are not left unbacked, and trace the minted funds on-chain.
- Audit every other place the program trusts a caller-supplied account, because this class of bug usually appears more than once.
Comment l’éviter
- Validate every sysvar account by comparing its key to the canonical id before reading from it.
- Verify the address and owner program of all caller-supplied accounts; never trust position in the accounts array.
- Use checked sysvar loaders (load_instruction_at_checked, load_current_index_checked) so unverified accounts fail closed.
- Adopt declarative account constraints (e.g. Anchor address constraints) instead of manual, omittable checks.
- Deploy security patches to mainnet immediately on merge; a public unpatched fix is an exploit roadmap.
Références
- https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022
- https://kudelskisecurity.com/research/quick-analysis-of-the-wormhole-attack/
- https://www.coindesk.com/business/2022/02/03/jump-trading-backstops-wormholes-320m-exploit-loss-sources
- https://www.coindesk.com/business/2023/02/24/oasis-exploits-its-own-wallet-software-to-seize-crypto-stolen-in-wormhole-hack
Vulnérabilités liées
Tout Web3 →- CRITICALWEB3-UWULEND-2024
On June 10, 2024, UwU Lend, an Aave-fork lending protocol on Ethereum, lost about $19.3 million, followed by a second ~$3.7 million drain on June 13, 2024 (combined ~$23 million). The root cause was flash-loan oracle manipulation of the sUSDe price feed: the custom sUSDePriceProviderBUniCatch oracle priced sUSDe as the median of 11 sources, 5 of which read instantaneous Curve pool spot prices via get_p (no TWAP/EMA smoothing) across the FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD and GHOUSDe pools. Using a roughly $3.8 billion flash loan, the attacker swapped large USDe amounts to suppress the median sUSDe price, set up positions, then reversed the swaps to inflate it, rendering their own leveraged position liquidatable and self-liquidating repeatedly to harvest base assets at favorable rates. Curve explicitly advises against using get_p spot reads for oracles. The June 13 follow-up reused collateral left from the first attack, since sUSDe was not disabled as borrowable collateral.
- CRITICALWEB3-INVERSE-2022
On 2 April 2022 Inverse Finance lost approximately $15.6 million on Ethereum when an attacker manipulated the INV price oracle feeding its Anchor money market. INV was priced by a Keep3r TWAP over the SushiSwap INV/ETH pair, but the oracle only folded a new price cumulative into the average when the elapsed time exceeded its 30-minute period, so shortly after a fresh update the oracle effectively returned the current manipulable spot price instead of a true time-weighted average. Using about 500 ETH of their own funds (no flash loan), the attacker bought INV on SushiSwap and routed ETH through Curve and DOLA into more INV, draining the thin INV/ETH pool and spiking the reported INV price, then deposited the inflated INV as collateral and borrowed ETH, WBTC, DOLA and YFI far exceeding its real value. The root cause was a TWAP whose update window let a single-block spot manipulation pass through as the reported price.
- CRITICALWEB3-HARVEST-2020
On 26 October 2020 Harvest Finance lost approximately $33.8 million (with about $2.5 million later returned) on Ethereum in a flash-loan price-manipulation attack against its fUSDT and fUSDC vaults. The vaults priced shares from the live spot exchange rate of Curve's Y-pool, so the attacker flash-borrowed tens of millions in USDT and swapped roughly $17M USDT into USDC through the pool to temporarily depress USDC and lift the pool's reported USDC value to about $1.01. While the pool was skewed, the attacker deposited USDC into the vault and minted shares at the inflated price, then reversed the Curve swap to restore the rate and redeemed the shares for more underlying than deposited, repeating the loop many times. The root cause was deriving deposit/withdraw share value from a single Curve pool's instantaneous spot rate, which is fully manipulable inside one flash-loan transaction.
- CRITICALWEB3-BZX-2020
In February 2020 bZx suffered two flash-loan price-manipulation attacks days apart, losing roughly $350,000 then roughly $650,000 (about $1M total) on Ethereum, the first widely studied flash-loan oracle attacks. In the first attack on 15 February the attacker flash-borrowed 10,000 ETH, opened a leveraged WBTC position through bZx's Fulcrum that internally swapped a large amount of ETH via Kyber into a thin Uniswap WBTC pool, spiking the WBTC spot price bZx read as its oracle, while a buggy collateral check skipped shouldLiquidate() and let the under-collateralized position stand. In the second attack on 18 February the attacker flash-borrowed ETH and pushed sUSD up to about $2 by buying it across Kyber reserves, then posted that sUSD at its manipulated spot value as collateral on bZx to borrow far more ETH than the position was worth. The root cause was pricing collateral from a single DEX's manipulable spot rate within one atomic transaction rather than a manipulation-resistant feed.
- CRITICALWEB3-KELPDAO-LAYERZERO-2026
On April 18, 2026, North Korea's Lazarus Group drained about 116,500 rsETH (roughly $292 million) from KelpDAO's LayerZero-based bridge, the largest DeFi exploit of the year. No smart contract was broken; the contracts did exactly what they were written to do. The attack was against the bridge's off-chain verification. rsETH's LayerZero channel was configured to trust a single verifier (a 1-of-1 DVN), so the attackers compromised LayerZero's internal RPC nodes, knocked out the honest external node with a denial-of-service flood, and forced that single verifier to attest to a cross-chain message that never really happened. The Ethereum side then released unbacked rsETH from escrow, leaving wrapped rsETH stranded across more than twenty chains and triggering a bank-run across DeFi.
- HIGHWEB3-FRONTEND-DNS-HIJACK-2022
A frontend hijack leaves the on-chain contracts untouched but replaces the Web2 surface serving the dApp UI with a wallet-drainer clone, so no Solidity audit can catch it. The recurring pattern: attackers take over the domain registrar or DNS provider account (or a CDN/tag-manager account), repoint the domain to a cloned site, and prompt visitors to sign malicious token approvals, EIP-2612 permit signatures, or transfers. Curve Finance was hit twice: on August 9-10, 2022 its curve.fi domain was DNS-hijacked via a compromised nameserver and drained ~$570K in USDC/DAI; and again around May 12, 2025 at the registrar level, after which Curve permanently migrated to curve.finance and announced an ENS move (Convex Finance and Resupply, which depend on Curve's data feeds, suffered dependency-driven outages but were not themselves compromised). In July 2024 a mass wave hit DeFi domains registered through Squarespace, whose forced migration off Google Domains stripped 2FA: Compound's frontend redirected to an Inferno Drainer clone and 100+ protocols were exposed (Celer blocked its takeover via domain monitoring). Ambient Finance's domain was hijacked through stolen registrar credentials on October 17, 2024. Most recently, on April 14, 2026 attackers used forged identity documents to social-engineer the registrar into handing over DNS control of CoW Swap's swap.cow.fi and cow.fi domains, redirecting users to a pixel-perfect drainer clone for about 90 minutes; over $1M was taken in roughly three hours, including 219 ETH (~$750K) from a single wallet, while CoW's contracts, backend APIs, and solver network were untouched. The same bucket includes CDN-account injections (KyberSwap's September 2022 Cloudflare/Google Tag Manager compromise, ~$265K) and BGP route hijacks that swap signed bundles for drainer code.