Cork Protocol hack — May 2025

Cork Protocol, an Ethereum protocol selling Depeg Swaps — hedges against liquid staking tokens losing their peg — was drained of 3,761 wstETH from its wstETH:weETH liquidity vault on 28 May 2025. Cork's own post-mortem times the first attack transaction at 11:39 UTC and values the loss at about $14.5 million. CoinDesk, citing monitoring firm Cyvers, reported roughly $12 million the same day, and that lower figure is the one most widely repeated. The stolen wstETH was swapped to ETH through the 1inch aggregator and held at a single attacker address.

Cork's post-mortem describes two chained flaws. First, the rollover pricing mechanism used a risk-premium calculation whose time-to-expiry term approaches zero. By buying 2.5 Depeg Swaps 19 minutes before a market expired, the attacker drove the computed risk premium to roughly 1,779.7 quadrillion per cent, skewing the historical implied-yield average so that the successor market initialised with Cover Tokens priced at 0.000002 wstETH each instead of fair value. Second, Cork's hook was built on a 30 January 2025 snapshot of Uniswap v4 periphery code that predated an explicit caller-authorization check added upstream on 6 February 2025. The attacker deployed a malicious hook contract that spoofed callback data, bypassing access control in Cork's hook and extracting 3,761 Depeg Swaps held in the FlashSwapRouter reserve, which were then redeemed for the underlying asset.

Cork had been reviewed by Sherlock, Quantstamp, Runtime Verification and Cantina, and parts of the system were formally verified; rekt.news reported that at least three of the four firms had the vulnerable CorkHook contract outside their defined scope. Cork paused all contracts within 57 minutes, said about $20 million remained locked across unaffected vaults, and engaged recovery partners. As of the post-mortem the stolen ETH was still unspent at the attacker's address, and no recovery has been reported.