Swapping More Than $157M of ETH for stETH and Levering Up, the Wormhole Network Exploiter Is a DeFi Degen

wallet that stole 80,000 ETH from the Wormhole Portal Token Bridge last year sprung back to life on Monday after 355 dormant days, trading on leverage like a true crypto twitter ‘degen’ as it moved a massive amount of capital throughout the DeFi ecosystem.

Data sourced from Etherscan indicates that the exploiter first swapped 95,360 ETH worth roughly $157 million on DeFi Aggregator OpenOcean and then transacted smaller amounts capital through several decentralized finance (DeFi) protocols such as Kyber Network and 1Inch.

The exploitation mobilized, borrowed dai and interacted with several smart contracts on lido, the first supplier of derivatives of liquid stapling on ethereum. The operator's address, which starts with 0x629, is now the 3rd owner of embedded stETH, according to the data analysis platform.

Darkfi.eth (not related to DarkFi, the layer 1 blockchain with the Lunarpunk philosophy), one of the hackers who exploited the Nomad bridge in Aug. 2022 to save its funds from malicious actors, said, 'There is a possibility that they will somehow use it to launder money. It's hard to say for sure, but there are certainly ways they could extract value from other portfolios of this activity.... It could also be Tho Lmao degenerates, a sort of speculation at this stage."

The exponent's Lido schemes were so massive as to have a material impact on the market for the popular liquid staking derivative. Its 24-hour trading volume is up over 3000%, per CoinGecko. During the chaos of the day, stETH’s price increased relative to ETH, jumping above its 1:1 peg temporarily, before settling at 0.9985, per Dune Analytics.

The operator's sudden activity made his victims react. In one transaction, an address belonging to Wormhole sent an on-chain message asking the exploiter to return the stolen funds in exchange for a $10 million bounty.

The vortex network operator did not send a query comment to coindesk through blockscan.

Here is the walk-through for the exploiter’s shuffle of funds

First, the Wormhole Network exploiter triggered a transaction on OpenOcean that swapped 96,630 ETH for 96,677 stETH, Lido’s derivative token that stands for the total value of a user’s initial staked ETH and its accrued interest.

Second, the Wormhole Network exploiter decided in another transaction to wrap 86,473 stETH.

Thirdly, the operator deployed 25,000 envelopes of stETH as security to borrow $13 million from DAI.

Fourth, the exploiter used the $13 million DAI it just borrowed to accumulate almost 8,000 stETH on Kyber Network, an Ethereum-based decentralized exchange.

Fifthly, the operator made a transaction to complete the approximately 8,000 tonnes it received a few moments ago.

Sixth, the operator was provided with $1.5 million per day.

Seventh, the developer traded the $1.5 million dai for approximately 923 steth through dex aggregator 1inch.

The operator has since continued to receive thousands of staked ether-wrapped chips (wstETH).