On February 2, 2022, the Wormhole Bridge - the principal cross-chain bridge between Ethereum and Solana, carrying approximately $1B in locked Ethereum assets at the time - was exploited via a signature-verification bypass that allowed the attacker to mint 120,000 wrapped ETH (wETH) on Solana without any corresponding Ethereum-side deposit. The attacker withdrew the equivalent value, valued at approximately $326M at the time, in what was then the second-largest DeFi theft to date, after the Poly Network exploit. The exploit rooted in an abandoned Solana-side update to the bridge's guardian-set logic: a deprecated solana_program function (load_instruction_at) failed to validate that a passed-in account was the legitimate Solana sysvar instructions account, allowing the attacker to forge a synthetic instructions account that vouched for an empty guardian signature set. The attacker thereby satisfied the bridge's 13-of-19 guardian signature requirement with zero actual signatures. Jump Crypto, principal market-maker and beneficial owner of significant Wormhole exposure via affiliate Jump Trading, posted a $326M bailout within twenty-four hours, fully replenishing the bridge's locked-ETH reserves. In February 2023, a substantial portion of the proceeds - roughly $140M net (about $225M in gross assets) - was recovered via a counter-exploit of the attacker's Oasis (Maker) vault positions, executed under an order of the High Court of England and Wales and returned to Jump Crypto; no public attribution of the attacker has been made.
Timeline of events
On January 13, 2022 - approximately three weeks before the exploit - Wormhole's Solana-side bridge contract code was updated by the Wormhole development team (then a Jump Crypto-affiliated effort) with new logic for guardian-set updates. The change deprecated a previous use of solana_program::sysvar::instructions::load_instruction_at and replaced it with a different validation pathway. Critically, the deprecated function call site was not removed from the contract; it remained as part of the verify_signatures path. The patched code shipped to mainnet on January 13. On February 2 at approximately 18:24 UTC, the attacker executed the exploit. The attacker submitted a Solana transaction with a synthetic instructions account constructed to look superficially like the genuine sysvar account; because the deprecated load_instruction_at function did not validate the account's owner, it accepted the synthetic data, which contained an empty guardian-signature set that nonetheless satisfied the bridge's threshold check (a known pathway: zero signatures against a maliciously-constructed signature-set commitment). The bridge contract then accepted a guardian-signed message authorizing the mint of 120,000 wETH on Solana. The attacker bridged approximately 93,750 wETH back to Ethereum via the bridge's reverse function, which actually held legitimate locked ETH; the remainder remained on Solana. Within ninety minutes of the exploit, on-chain investigators including @samczsun (Paradigm) and @kelvinfichter (Optimism) had reverse-engineered the attack and posted public technical breakdowns. By February 3 at 02:00 UTC, Wormhole had publicly disclosed the exploit and announced a planned remediation, and Jump Crypto had committed to backstopping the locked-ETH shortfall.
Attack mechanism
The technical mechanism is now well-documented in post-mortems by Wormhole, Certik and Trail of Bits. Wormhole's cross-chain message-passing relies on a network of nineteen guardians (validators) operated by various entities including Jump Crypto, Certus One, Everstake, and Figment. A cross-chain transfer from Ethereum to Solana proceeds in three phases: (1) a deposit into the Wormhole core contract on Ethereum, (2) a guardian-signed Verifiable Action Approval (VAA) message confirming the deposit, and (3) a redemption transaction on Solana that mints the wrapped asset. The Solana-side mint requires that thirteen of the nineteen guardians have signed the VAA, verified by the bridge contract's verify_signatures function. The vulnerability lay in how that function validated the account passed in as the Solana sysvar instructions account - a special account that lets a Solana program inspect the other instructions in the same transaction. The deprecated solana_program function load_instruction_at checked the data layout of the passed account but not its owner, meaning a caller could pass any account whose data happened to look correctly structured. The attacker constructed an entirely synthetic account with a hand-crafted byte layout that mimicked the sysvar, and inside that synthetic data placed a manufactured signature-set commitment that the verify_signatures function accepted. The 13-of-19 threshold was satisfied with zero actual guardian signatures. A subsequent mint instruction created 120,000 wETH from nothing on Solana. Approximately 93,750 of those wETH were then burned in exchange for an unlocking of the corresponding ETH on Ethereum, draining the legitimate Ethereum-side reserves directly.
Root cause analysis
There are three nested root causes. The proximate technical cause is that solana_program's load_instruction_at function did not validate the owner of the account passed to it, an issue the Solana team had recognized and addressed by introducing a replacement function (load_current_index_checked) but had not enforced via deprecation warnings or compiler errors against legacy callers. Wormhole's January 13 update partially migrated to the safer function but left the unsafe call site in the verify_signatures path. The contributing cause is that Wormhole's pre-deployment review process did not flag the dual code paths; the audit by Neodyme had identified the unsafe pattern in earlier code but the patch as deployed introduced the vulnerable surface in a slightly different form not covered by the existing audit. The deeper structural cause is that bridges holding $1B+ in locked assets had become a high-value target without commensurate review rigor; Wormhole's deployment cadence and audit budget were not calibrated to the level of locked-value exposure the bridge had accumulated through 2021 as Solana DeFi grew rapidly. The cross-cutting lesson, applicable to bridges generally, is that any function in a bridge's verification path that touches privileged or system accounts must validate ownership before trusting the account's data, and that any deprecation of an unsafe primitive must be accompanied by elimination of all caller sites, not partial migration. The Wormhole patch had moved most callers to the safe function but missed one in the highest-value path.
Initial response and recovery
Wormhole's response was rapid and structurally consequential. Within ninety minutes of the exploit, the Wormhole team had paused new bridge transfers on the contract pause-switch and begun engineering a patch. Within four hours, public communications were issued via Twitter. Critically, within twenty-four hours, Jump Crypto posted approximately 120,000 ETH to the bridge contract from corporate balance sheet, fully restoring the wrapped-ETH backing on Solana to its pre-exploit level. The bailout was not legally required - Jump was a contributor to and significant beneficiary of Wormhole rather than its operator in any traditional fiduciary sense - but Jump's exposure to Solana DeFi via Jump Trading made a Wormhole insolvency commercially intolerable. The patched contract was redeployed on February 3 at approximately 18:00 UTC after expedited review by Neodyme; the bridge resumed normal operation within approximately twenty-eight hours of the exploit. The locked-ETH gap was permanently absorbed by Jump rather than passed to users; no Wormhole user lost funds in net terms despite the attacker retaining the $326M extraction. The total economic impact was therefore borne by Jump Crypto (the $326M write-down against Jump's balance sheet) and by Wormhole's reputation among DeFi practitioners, the latter of which has partially but not fully recovered.
Funds tracking and laundering
The attacker behaved patiently. Approximately 93,750 wETH were unlocked on Ethereum side and remained on attacker-controlled addresses without immediate movement, an unusual pattern that distinguished Wormhole from most major bridge thefts. Throughout February and March 2022, on-chain trackers including Chainalysis, Elliptic, and Paradigm researchers monitored the wallet, observing only periodic small consolidations. Wormhole publicly offered the attacker a $10M whitehat bounty, which was never accepted. The attacker began moving the principal into staking and lending positions in DeFi protocols on Ethereum (notably Lido stETH and various Aave deposit positions), generating yield while remaining publicly trackable. In late 2022 and 2023, portions of the principal were used to short-sell ETH via on-chain perpetual futures (notably on dYdX and GMX), a pattern that researchers including ZachXBT noted was unusually sophisticated for typical theft proceeds and may indicate that the attacker was a fund or quantitative actor rather than a state-affiliated group. Use of Tornado Cash for laundering was relatively limited compared with Lazarus-attributed thefts; most of the obfuscation occurred via cross-chain hops and DeFi position layering. In February 2023, roughly $140M net (about $225M in gross assets) of the proceeds was recovered when Oasis.app, acting under an order of the High Court of England and Wales, executed a counter-transaction that moved the attacker's staked-ETH vault positions to a Jump Crypto-controlled wallet; no public attribution of the attacker has ever been made.
Legal and regulatory aftermath
In notable contrast to Ronin, the Wormhole exploit produced minimal regulatory enforcement, primarily because no public attribution to a sanctionable actor was ever made. The U.S. Treasury and FBI did not list the attacker addresses, and the SEC did not open an action against Wormhole. Jump Crypto's $326M bailout was structured as a discretionary contribution rather than a forced restitution, avoiding most U.S. tax-deductibility complications but also leaving questions about whether Jump's exposure to Wormhole had constituted unregistered securities activity. No direct enforcement against Jump over its Wormhole involvement was undertaken. In 2024, a class-action filing in California briefly attempted to characterize the bailout as evidence of Jump having implicit fiduciary control over Wormhole, but the suit was dismissed at the pleading stage. The most consequential regulatory effect was indirect: the Wormhole exploit, alongside Ronin and subsequent bridge incidents, drove a sustained Treasury and FinCEN focus on bridge architecture as a money-laundering vector, contributing to the rule-making around cross-chain transfer monitoring that took effect under the proposed FinCEN guidance of 2024.
Industry implications
Wormhole reshaped three areas of bridge practice. First, audit rigor: the era of bridges relying on a single audit at deployment ended; Wormhole and successor bridges adopted continuous-audit models with multiple independent firms (Trail of Bits, OpenZeppelin, Neodyme, Certik) reviewing all contract changes plus formal-verification pipelines for verification-path code. Wormhole specifically published a $10M ongoing bug bounty after the incident, since paid out to multiple researchers for findings that could have produced similar exploits. Second, Solana program-account validation became a recognized first-class concern: the Solana developer ecosystem accelerated work on the Anchor framework's account-constraint macros which make owner-validation declarative, and the Solana core team eventually deprecated the unsafe load_instruction_at function entirely with compiler errors for legacy callers. Third, the bailout precedent: Jump Crypto's $326M backstop established a template that protocol-affiliated capital sources would absorb bridge losses to preserve commercial integrity, a template subsequently followed in different forms by Binance for the BNB Chain bridge incident, and partly by Multichain's institutional partners. The broader effect on bridge market structure was a flight to bridges with stronger economic-security models or institutional backstops, with smaller and less-capitalized bridges progressively losing TVL share through 2022-2024.
Verdict and lessons
Wormhole is a near-pure smart-contract failure case, in contrast to Ronin (operational/key compromise) or FTX (governance/fraud). The vulnerability was a single function call that did not validate an account owner, in a code path that had been partially refactored without removing the legacy unsafe call site. A perfectly competent audit-and-deploy process would have caught the issue; Wormhole's process at the time did not. The lessons for bridge engineering are concrete: any function in a verification path must validate ownership of every account it inspects; deprecation of unsafe primitives must remove all caller sites, not partially migrate; ongoing audit cadence must be calibrated to the cumulative locked value and updated whenever that value crosses an order of magnitude; and formal verification of verification-path code is a worthwhile investment for bridges holding nine-figure value. The Jump Crypto bailout, while commercially decisive, set up an awkward precedent: bridge users learned that a sufficiently well-capitalized affiliate could absorb a $326M loss, but that lesson does not generalize to bridges without such an affiliate, and the proliferation of smaller bridges in 2022-2023 produced a cohort of incidents (Nomad, Multichain, Harmony Horizon) where no equivalent backstop was available. The structural lesson is that bridge architecture must be designed around the assumption that any given exploit will not be backstopped, with economic-security and decentralized-validator models that distribute the loss rather than concentrate the rescue. The attacker, four years on, remains unidentified.
Root cause
Wormhole's Solana-side verify_signatures function used the deprecated solana_program::sysvar::instructions::load_instruction_at function in a code path retained after a partial January 13, 2022 refactor. That function did not validate the owner of the account it inspected, allowing the attacker to pass a synthetic account whose data mimicked the sysvar instructions account and contained a manufactured signature-set commitment. The 13-of-19 guardian threshold check was satisfied with zero actual signatures, allowing minting of 120,000 wETH on Solana, of which approximately 93,750 was bridged back to drain the legitimate Ethereum-side ETH reserves.
Recovery and aftermath
Jump Crypto fully replenished the locked-ETH shortfall via a ~$326M discretionary bailout within 24 hours of the exploit. No Wormhole user lost net funds. In February 2023, roughly $140M net (about $225M in gross assets) of the attacker's proceeds was recovered via a court-ordered counter-exploit of his Oasis (Maker) vault positions, with the assets returned to Jump Crypto; the remainder has not been recovered as of April 2026.
Lessons
- Every account inspected in a verification path must have its owner validated; account-data shape is not sufficient evidence of authenticity
- Deprecation of unsafe primitives must remove all caller sites and ideally enforce compiler errors on legacy callers; partial migration is worse than no migration
- Audit cadence must be tied to cumulative locked-value thresholds, with mandatory re-audit when value crosses order-of-magnitude boundaries
- Bridge architectures must be designed around the assumption of no backstop; economic-security and decentralized-validator models distribute loss rather than concentrate rescue
Precedent
Established the institutional-bailout template for bridge exploits subsequently followed (in modified form) by Binance for BNB Chain bridge and others. Drove industry-wide adoption of continuous-audit models, formal verification of bridge verification-path code, and Solana ecosystem deprecation of unsafe sysvar-handling primitives.