Hacker Steals $320 Million From Solana, Ethereum Bridge Wormhole

Wormhole, a protocol that allows users to move their tokens and NFTs between Solana and Ethereum, has confirmed that it suffered an exploit of 120,000 Wrapped Ethereum, worth over $320 million—higher than the $250 million originally suspected.

Earlier on Wednesday, a post on Wormhole's Twitter account noted the network was "down for maintenance" due to a "potential exploit." But by that point the exploit, pointed out by Paradigm security researcher samczsun, appeared to be real. A message on the Ethereum blockchain, purportedly from Wormhole, states: "We noticed that you were able to exploit the Solana VAA verification and mint tokens. We would like to offer you a whitehat agreement, and present you a bug bounty of $10 million for exploit details, and returning the wETH you have minted."

VAA stands for "validator action approval," and refers to the process by which transactions get approved.

The message means that Wormhole assumes with a wink and nod that the hacker acted in good faith. In return, it will give them $10 million for pointing out a vulnerability. But it wants its quarter-billion back.