Wormhole hacker moves $155M in biggest shift of stolen funds in months

Published at: Jan. 24, 2023

The hacker behind the $321 million Wormhole bridge attack has shifted a large chunk of stolen funds, with transaction data showing that $155 million worth of Ether (ETH) was transferred to a decentralized exchange (DEX) on Jan 23.

The Wormhole hack was the third largest crypto hack in 2022, after the protocol’s token bridge suffered an exploit on Feb. 2, 2022, that resulted in the loss of 120,000 Wrapped ETH (wETH) around worth $321 million.

According to the transaction history of the hacker’s alleged wallet address, the latest activity shows that 95,630 ETH was sent to the OpenOcean DEX and then subsequently converted into ETH-pegged assets such as Lido Finance’s staked ETH (stETH) and wrapped staked (wstETH).

#CertiKSkynetAlert We are seeing address 0x629e… Wormhole Network Exploiter swap 95,630 Ether (~$155M) to stETH Stay safe! pic.twitter.com/ZR6zxlRuKX

— CertiK Alert (@CertiKAlert) January 23, 2023

Digging into the transaction history further, crypto community members such as @spreekaway also highlighted that the hacker went on to conduct a slew of odd looking transactions.

For example, the hacker used their stETH holdings as collateral to borrow 13 million worth of the DAI stablecoin, before swapping it out for more stETH, wrapping into stETH again and then borrowing some more DAI.

Wormhole exploiter has converted his ETH to wstETH and is going to borrow DAI against it it seems. pic.twitter.com/9rhERSMG5u

— Spreek (@spreekaway) January 23, 2023

Notably, the Wormhole team has taken the opportunity to once again offer the hacker a bounty of $10 million if they return all the funds, after it left an embedded message conveying such in a transaction via the Wormhole: Deployer.

The hacker’s hefty ETH transaction appears to have had a direct impact on the price of stETH according to data from Dune Analytics. The asset’s price went from slightly under peg of 0.9962 ETH on Jan. 23, to as high as 1.0002 ETH the following day, before dropping back to 0.9981 at the time of writing.

With the Wormhole hack likely to catch more attention in light of the latest incident, blockchain security firms such as Ancilia, Inc. warned on Jan. 19 that searching the keywords “Wormhole Bridge” in Google is currently showing promoted ad websites that are actually phishing operations.

The community has been warned to be diligent on what they are clicking on relating to this term.

#phishing alert When you search "wormhole bridge" in Google, many of the "ad" entries are actually phishing site. E.g.hxxps://wormholebridge-multichain.com/hxxps://portaltoken-wormholebridge.com. Be careful about what you click and stay safe! pic.twitter.com/C6JW2xeaUh

— Ancilia, Inc. (@AnciliaInc) January 19, 2023