The Wormhole Bridge Hack: $325M Minted From Thin Air

1. 1

   Solana's lifeline to Ethereum

   Wormhole was the pipe between two of crypto's biggest worlds. Deposit real ETH into its contract on Ethereum, and the bridge mints you wrapped ETH (wETH) on Solana, one to one — burn the wETH and you get the ETH back. By early 2022 that promise had made Wormhole Solana's most important bridge: more than 100,000 ether, roughly a quarter of a billion dollars, sat behind its contracts, and Solana DeFi priced its lending markets and liquidity pools in wETH as if it were the real thing. Every loan collateralized with wETH was, indirectly, collateralized by a single promise: no wETH gets minted unless the bridge sees a deposit it can truly verify.

   

2. 2

   19 watchers, 13 signatures, one guarantee

   How does the far side know a deposit really happened? It trusts Guardians — 19 off-chain watchers that observe each Ethereum deposit and sign a message attesting to it, called a VAA (Verified Action Approval). Hand the Solana-side bridge a VAA carrying 13 of the 19 signatures, and it mints your wrapped ether, no further questions. The video's diagram draws the whole religion in one line: the signature check in step 3 is the entire security of the bridge. No signatures, no mint; enough signatures, unconditional mint. Everything that follows — the theft, the fix, this whole page — flows from a single question the bridge had to answer correctly every single time: who decides what counts as a real signature?

   

1. 3

   The bug: it checked the wrong thing

   To be safe, the bridge must verify every signature against its own fixed list of real Guardians — a list no caller can touch. Wormhole's Solana program trusted an input the caller could control instead. The real-world version was a deprecated Solana built-in: the bridge used load_instruction_at, a function that reads another account's instructions without checking where that account comes from. Solana had replaced it with a checked version right before Wormhole deployed, but the bridge shipped with the old one. So the attacker stood up their own account imitating the system account, used it to feed the verification routine a forged signature set, and the bridge — believing it was reading Solana itself — accepted the result. The check passed, and it minted 120,000 wETH, unbacked.

   

2. 4

   The trap inside the verification code

   The video's rebuild makes the flaw legible in a few lines. A guardian hashes the withdrawal details — who gets paid, how much, a nonce — into a digest and signs it with a 65-byte signature. The bridge calls recover(digest, sig), which returns the address that produced the signature. Crucially, recover never fails: it always returns some valid address. So the only real question is whether that address belongs to a guardian — and the vulnerable code answers it against claimedGuardians, a list handed in by whoever calls the function. The frame marks the exact line: require(_in(claimedGuardians, signer)) — the caller's set. The caller supplied both the signatures and the list they were judged against.

   

1. 5

   The address Etherscan labels 'Wormhole Network: Exploiter'

   On February 2, 2022, the attacker ran the trick for real: a forged deposit attestation — signatures produced by an attacker-created account the bridge mistook for a Solana system account, holding all of 0.1 ETH of collateral — and the contract minted 120,000 wETH, about $325 million at the prices of the day. Etherscan now labels the attacker's address, 0x629e…796b, 'Wormhole Network: Exploiter' under a red warning banner, and shows the wallet was first funded from Tornado Cash. No deposit ever happened on Ethereum. The bridge was simply convinced that one had — because the attacker, not the Guardians, got to define what counted as proof.

   

2. 6

   The whole con, on one recap card

   Fake IOUs are only worth what you can swap them for, and the attacker cashed out fast. Per blockchain-analytics firm Elliptic, 93,750 of the 120,000 minted wETH were bridged back to Ethereum in three transactions, redeeming real ether straight out of Wormhole's vault, while most of the rest — around another 36,000 worth — was swapped into USDC and SOL. The damage radiated outward instantly: all the wETH sitting in Solana's lending markets was suddenly an IOU for ether that didn't exist — the 'domino effect of now uncollateralized loans against Wormhole ETH,' as Paradigm's Georgios Konstantopoulos put it — and SOL fell about 13.5% in a day. The recap card in the frame compresses the con into three lines: mint on guardian signatures, trust the caller's set, mint 120,000 wETH from nothing.

   

1. 7

   A tiny bridge, three acts

   The only way to really understand this bug is to watch it run. The video rebuilds a minimal version of the bridge in Foundry, the standard Ethereum development toolkit — a tiny contract that mints on 'guardian' signatures — and stages the exploit as three acts. Act one, the honest case: real guardians sign a genuine deposit and the mint works. Act two, the attack: the attacker signs with their own keys, calls them guardians, and mints a fortune from nothing. Act three, the fix: check against the real guardian set and the attack dies. Those same three acts played out on mainnet in February 2022 — with $325 million of real money standing in for the test ether.

   

2. 8

   Read the test before you run the attack

   Before running anything, the video reads the test — because the test file is the whole story in comments and asserts. Act one deploys the bridge with the real guardian set, has two of three guardians sign a legitimate 10-token deposit, and asserts the user actually receives their 10. Act two's comment is the exploit in one breath: signatures verified against the caller's set — the attacker passes their own keys in as 'guardians' and mints 120,000 wETH out of thin air; no deposit, and no bug in the signatures themselves, which are perfectly valid — just not from the real guardians. Act three points the same forged signatures at the fixed bridge and expects a revert: 'not a guardian.'

   

3. 9

   Act 1: the honest mint passes

   First, prove the bridge works when nobody cheats. The test builds a genuine 10 wETH withdrawal, hashes it into a digest, signs it with the real guardians' keys, and passes the signatures in alongside the real guardian list. The bridge verifies each signature against that list, counts them against its quorum, and mints exactly 10. The terminal prints the result: [PASS] test_1_honest — 'user minted (honest): 10.000…' — one passed, zero failed. This green baseline is what makes the next frame damning: in the attack, nothing about the cryptography changes. Same curve, same recover, same bridge. Only the list changes.

   

4. 10

   Act 2: 120,000 wETH from nothing

   Now the attack — and notice how little changes. Same bridge, same digest, same function. The only difference: the signatures come from the attacker's own two keys, and the guardian list passed in contains those same two addresses. Every check still passes, because every signature is technically valid — recover returns the attacker's addresses, and they match the attacker's list. The terminal delivers the punchline: [PASS] test_2_attack — 'attacker MINTED (no deposit): 120000.000…' — suite green, 120,000 wrapped ether conjured out of thin air. That is the $325 million bug reproduced in milliseconds: the bridge had no way to tell the real Guardians from the ones the caller invented, because it never asked.

   

1. 11

   Act 3: the one-word fix

   The fix is small enough to fit in a comment block, and the frame shows it side by side. Before (vulnerable): receiveAndMint took a claimedGuardians parameter — the list from the caller — and required each signer to be in it. After (fixed): the parameter is gone entirely; the function checks _in(guardians, signer), where guardians is the list the contract stored once at deployment and no caller can change. Same signatures, same recover, same quorum — the only change is who owns the list the signatures are measured against. As the video puts it: any time a contract checks trust against data the caller supplies, that's not security. It's a suggestion.

   

2. 12

   The fix test: expect 'not a guardian'

   The fix gets its own test, and it does everything the attack did: same attacker, same self-made key set, same demand for 120,000 wrapped ether — all pointed at the fixed bridge. The difference is the expectation. This test wraps the call in vm.expectRevert(bytes("not a guardian")), telling Foundry that the correct outcome is rejection, then asserts the attacker's balance is still zero. If the signature check is pinned to the real, stored guardian set, the identical attack cannot mint so much as one wei. One moved word — claimedGuardians becomes guardians — and an entire class of exploit goes from 'prints money' to 'reverts.'

   

3. 13

   The attack, rerun: revert, zero balance

   Run it and watch the same heist die. The identical forged signatures that minted a fortune a moment ago now bounce off the fixed bridge, and the terminal shows it: [PASS] test_3_fixed — 'attacker minted (fixed): 0.000000000000000000' — one passed, zero failed. The attack that conjured $325 million on mainnet in February 2022 has been reduced to a revert reason and a zero balance. That is the whole defense in one screenshot: pin the trusted set inside the contract, never accept it from the caller, and remember that a perfectly valid signature from the wrong signer is still an attack.

   

4. 14

   The $10M offer, and the check that made it whole

   The code was broken, but the ending wasn't — because someone decided to pay. Wormhole first tried diplomacy, broadcasting an on-chain message to the exploiter offering a $10 million whitehat bounty for the return of the minted wETH. No reply came. Within about 24 hours the hole was filled anyway: Jump Trading, the trading giant that had incubated Wormhole, injected 120,000 ETH so every wETH was backed 1:1 again — the largest self-funded rescue in DeFi history. Bankless, recording that week, cheered for the users being made whole and worried aloud about the precedent: a happy ending nobody should bank on, because there isn't always a Jump. The lesson card in the frame is the code version of the same story — verify against the right list, or someone richer than you pays for the wrong one.

   

5. 15

   Seven weeks later: Ronin, the mirror image

   The outro card promises 'Next: another hack, rebuilt' — and the next one was already scheduled. On March 23, 2022, seven weeks after Wormhole, attackers took the Ronin Bridge for $615 million, then the largest DeFi theft on record. The two hacks are mirror images. Wormhole died of a code flaw: nobody's key was stolen — the signatures were simply checked against the wrong list. Ronin died of social engineering: the code was fine, but the attackers befriended their way to 5 of 9 validator keys, and the threshold did the rest. Same wound both times — a bridge's trust assumptions, broken from a different side. The era after Wormhole brought mandatory audits, bug bounties, rate limits and redesigned proof systems, and the rule from the rebuild still sorts the survivors: pin the trusted set, and never let the caller tell you who the trusted are.

   

Continue the Story