Wormhole hack — February 2022
Incident facts
| Date of incident | |
|---|---|
| Target type | Cross-chain bridge |
| Loss | $326,000,000Published estimates range $320,000,000 to $326,000,000Price at time of incident |
| Method | Signature verification flawDeprecated function let a forged guardian signature pass verification |
| Chains | Solana, Ethereum |
| Outcome | Users reimbursed |
What happened
The Wormhole bridge between Solana and Ethereum lost 120,000 wrapped ETH on 2 February 2022, worth roughly $320m to $326m at the time.
Wormhole mints wrapped assets on one chain against assets locked on another, and the mint is authorised by signatures from a set of guardians. The contract used a deprecated Solana function that did not check the address of the account holding the signature data. That allowed the attacker to present a forged set of signatures, which the contract accepted, and mint 120,000 wETH on Solana without locking anything on Ethereum. Most of it was then bridged back to Ethereum as real ETH.
Jump Crypto, whose subsidiary had built the protocol, replaced the missing funds within a day so that the wrapped assets stayed fully backed and users lost nothing. A year later Jump and Oasis recovered a substantial part of the attacker's holdings through a counter-exploit of the vault the attacker had used, an action that drew its own criticism over the mutability of the vault involved.
No attribution was established.
Sources
- HalbornSecondary · retrieved 2026-08-01
- CoinDeskSecondary · retrieved 2026-08-01
- BlockworksSecondary · retrieved 2026-08-01
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Wormhole hack — February 2022", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/wormholehttps://itokenly.com/hacks/wormholePermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.