BlocksInform
The hacker behind the $321 million attack moved a whole bunch of stolen money, with transaction information indicating that $155 million of ether () was transferred to a decentralized exchange (dex) on January 23.
The Wormhole hack was the third largest crypto hack in 2022, after the protocol’s token bridge suffered an exploit on Feb. 2, 2022, that resulted in the loss of 120,000 Wrapped ETH (wETH) around worth $321 million.
According to the transaction history of the hacker’s alleged wallet address, the latest activity shows that 95,630 ETH was sent to the OpenOcean DEX and then subsequently converted into ETH-pegged assets such as Lido Finance’s staked ETH (stETH) and wrapped staked (wstETH).
We are seeing address ??0x629e… Wormhole Network Exploiter swap 95,630 Ether (~$155M) to stETH
Stay safe! pic.twitter.com/ZR6zxlRuKX
— CertiK Alert (@CertiKAlert) January 23, 2023
Digging deeper into the transaction history, members of the crypto community like @spreekaway also pointed out that the hacker continued to perform a series of strange transactions.
For example, the hacker used their stETH holdings as collateral to borrow 13 million worth of the DAI stablecoin, before swapping it out for more stETH, wrapping into stETH again and then borrowing some more DAI.
The vortex operator has converted into wsteth and will borrow dai against it apparently. pic.twitter.com/9rhERSMG5u
— Spreek (@spreekaway) January 23, 2023
Notably, The Wormhole team took the opportunity to offer the hacker another $10 million bonus if they return all the funds, after it has left a built-in message to transmit in a transaction through the Wormhole: Deploy.
The hacker’s hefty ETH transaction appears to have had a direct impact on the price of stETH according to data from Dune Analytics. The price of the asset went down from a little less than 0.9962 on January 23, up to 1,0002 the day after, before returning to 0.9981 when drafted.
Related: North Korea's Lazarus Group masterminded $100M The FBI corroborates that.
With the Wormhole hack likely to catch more attention in light of the latest incident, blockchain security firms such as Ancilia, Inc. warned on Jan. 19 that search keyword "wormhole bridge" in Google currently shows promoted ad sites that are in fact phishing operations.
The community was warned to be diligent about what it clicks on with respect to that term.
#phishing alert When you look for "wormhole bridge" in Google, many of the entries "advertisement" are actually phishing site. E.g.
hxxps://wormholebridge-multichain.com/
hxxps://portaltoken-wormholebridge.com. Pay attention to what you click and keep it safe! Pic.twitter.com/C6JW2xeaUh
— Ancilia, Inc. (@AnciliaInc) January 19, 2023
