Wormhole hacker moves $155M in biggest shift of stolen funds in months

The hacker down the $321 cardinal Wormhole span onslaught has shifted a ample chunk of stolen funds, with transaction information showing that $155 cardinal worthy of Ether (ETH) was transferred to a decentralized speech (DEX) connected Jan 23.

The Wormhole hack was the third largest crypto hack successful 2022, aft the protocol’s token span suffered an exploit connected Feb. 2, 2022, that resulted successful the nonaccomplishment of 120,000 Wrapped ETH (wETH) astir worthy $321 million.

According to the transaction history of the hacker’s alleged wallet address, the latest enactment shows that 95,630 ETH was sent to the OpenOcean DEX and past subsequently converted into ETH-pegged assets specified arsenic Lido Finance’s staked ETH (stETH) and wrapped staked (wstETH).

— CertiK Alert (@CertiKAlert) January 23, 2023

Digging into the transaction past further, crypto assemblage members specified arsenic @spreekaway besides highlighted that the hacker went connected to behaviour a slew of unusual looking transactions.

For example, the hacker utilized their stETH holdings arsenic collateral to borrow 13 cardinal worthy of the DAI stablecoin, earlier swapping it retired for much stETH, wrapping into stETH again and past borrowing immoderate much DAI.

Wormhole exploiter has converted his ETH to wstETH and is going to get DAI against it it seems. pic.twitter.com/9rhERSMG5u

— Spreek (@spreekaway) January 23, 2023

Notably, the Wormhole squad has taken the accidental to erstwhile again connection the hacker a bounty of $10 cardinal if they instrumentality each the funds, aft it near an embedded connection conveying specified successful a transaction via the Wormhole: Deployer.

Embedded message: Etherscan

The hacker’s hefty ETH transaction appears to person had a nonstop interaction connected the terms of stETH according to data from Dune Analytics. The asset’s terms went from somewhat nether peg of 0.9962 ETH connected Jan. 23, to arsenic precocious arsenic 1.0002 ETH the pursuing day, earlier dropping backmost to 0.9981 astatine the clip of writing.

Related: North Korea's Lazarus Group masterminded $100M Harmony hack: FBI confirms

With the Wormhole hack apt to drawback much attraction successful airy of the latest incident, blockchain information firms specified arsenic Ancilia, Inc. warned connected Jan. 19 that searching the keywords “Wormhole Bridge” successful Google is presently showing promoted advertisement websites that are really phishing operations.

The assemblage has been warned to beryllium diligent connected what they are clicking connected relating to this term.

#phishing alert When you hunt "wormhole bridge" successful Google, galore of the "ad" entries are really phishing site. E.g.
hxxps://wormholebridge-multichain.com/
hxxps://portaltoken-wormholebridge.com. Be cautious astir what you click and enactment safe! pic.twitter.com/C6JW2xeaUh

— Ancilia, Inc. (@AnciliaInc) January 19, 2023