A Solana bridge called Wormhole has been exploited for as much as $320 million, according to reports emerging on Feb. 3.
The team posted a notice that the bridge had been hacked, losing 120,000 wrapped ETH valued at around $320 million at the time. It explained that ETH will be added to ensure the wrapped variant in the bridge is fully backed.
At the time of writing, the latest announcement on the Wormhole Twitter feed was that the vulnerability had been patched and that they were working at restoring the network.
Paradigm security researcher “samczsun” has delved into the attack stating that the perpetrator either got the private keys or they exploited the bridge. He added that there was a “corresponding transaction on Solana where the attacker bridged out the ETH.” The hacker essentially exploited a vulnerability to mint wETH without depositing ETH themselves.
Tom Robinson, the co-founder of blockchain analysis firm Elliptic, commented:
“This demonstrates once again that the security of DeFi services has not reached a level that is appropriate for the huge sums being stored within them. The transparency of the blockchain is allowing attackers to identify and exploit major bugs.”
A message on the Ethereum blockchain from the Wormhole developers has offered a bounty for returning the loot:
“We noticed that you were able to exploit the Solana VAA verification and mint tokens. We would like to offer you a whitehat agreement, and present you a bug bounty of $10 million for exploit details, and returning the wETH you have minted.”
Wormhole was developed by blockchain engineering firm Certus One which was acquired by Jump Trading in August. On Feb. 1, Solana Labs announced the launch of its payments app Solana Pay.
The bridge hack is the latest in a lengthening list of woes for Solana, which includes four network outages in as many months.
SOL prices have tanked over the past 8 hours, falling 12% from around $111 to $97 at the time of writing. The token is now trading 62.5% down from its Nov. 6 all-time high of $260.
Solana has often been touted as an “Ethereum killer,” but this latest setback, in addition to the multiple network and performance issues it has recently suffered, makes this moniker moot.