Millions of dollars in cryptocurrency taken from Wormhole accounts late Wednesday have been restored to users, according to the company’s leaders.
Wormhole is a decentralized finance (DeFi) platform that allows users to exchange Solana for other cryptocurrencies directly on decentralized apps (dApps) running on the Ethereum blockchain, a service known as a “blockchain bridge.”
How $323M in crypto was stolen from Wormhole
According to CBSNews, Wormhole first announced the hack of its bridge platform late Wednesday night, saying the company’s system was down temporarily so that its maintenance team could “look into a potential exploit.” Wormhole later announced that hackers had taken 120,000 wrapped Ethereum tokens, or wETH, worth roughly $320 million.
Wrapped Ethereum is simply Ethereum money that can be traded. Any wETH taken in the hacking would be replaced with plain (non-wrapped) Ethereum tokens, according to Wormhole’s tweet.
Wormhole tweeted on Thursday that “all monies have been restored” and that its system was back to normal. Wormhole has not stated whether or whether the stolen funds were recovered, or how the hack occurred in the first place.
Security should be a standard practice
The attacker deceived Wormhole into taking sysvar instructions from fake ones they made during Wormhole’s signature verification procedure by using a series of blockchain transactions to introduce fraudulent credentials. In short, the attacker took advantage of Wormhole’s failure to properly validate the accounts, allowing them to enter their own false orders that gave the impression that they had the right to mint Ethereum.
According to Roger Grimes, a data-driven defense evangelist for KnowBe4, secure development lifecycle (SDL) code should be common practice for everyone. “Most developers and smart contact builders aren’t educated in SDL and receive little to no secure development training,” Grimes added.
As a result of the training shortfall, more code containing more exploits (many of which are popular and easy to exploit) gets released into the world.
“The cryptocurrency world is an immature enterprise utilizing immature code, racing ahead at warp speed,” Grimes cautions, “with billions of dollars in value.” Per TechRepublic, when you combine it with a community that shudders at the prospect of regulation, you have the perfect storm for crimes like the Wormhole hack, which enriched an individual attacker for very little risk.
Read More:
IRS Tax Refund 2022: Let’s Calculate How Much You Will Receive!
