By exploiting a vulnerability in the software of a crypto trading platform, hackers stole 320 million in cryptocurrencies.
Wormhole Portal is a web-based application that allows users to convert one form of cryptocurrency into another. These portals are often referred to as blockchain bridges. Basically they use Ethereum smart contracts (computer code stored on a blockchain) to connect the input currency and the desired output currency.
The attacker is believed to have exploited this process to trick the Wormhole project into releasing Ether (ETH) and Solana (SOL) coins for a far greater value than their input value.
How were the attackers able to pull this off?
Wormhole didn’t properly validate all input accounts, which allowed the attacker to spoof guardian signatures and mint 120,000 ETH on Solana, of which they bridged 93,750 back to Ethereum.
How did the @wormholecrypto exploit work? I joined forces with @gf_256 and @ret2jazzy to reverse engineer the exploit, and now that it’s been patched we can finally share it with you👇 pic.twitter.com/lXwD0GLZ3N
— samczsun (@samczsun) February 3, 2022
Award Offered for Details on the Attack
The platform is offering a $10 million award for the stolen money and details about the attack.