The Wormhole Hack: How $320 Million Disappeared From a Cross-Chain Bridge in Minutes

On February 2, 2022, a single attacker found a flaw in Wormhole’s Solana smart contract, forged a valid signature, and minted 120,000 wrapped ETH out of thin air — worth $320 million. By the time most users noticed, the funds were gone. The Wormhole hack stands as one of the largest single DeFi hacks in history, and it happened not because of a sophisticated cryptographic break, but because of a code oversight that a thorough audit might have caught. Then something completely unprecedented happened: a private company replaced every single penny within hours. This is the story of how it happened, what it reveals about bridge security, and what you should know before you ever use one.

What Wormhole Is — and How Bridges Actually Work

If you’ve ever wanted to move an asset from one blockchain to another — say, take ETH from Ethereum and use it in a Solana DeFi application — you need a bridge. Bridges are protocols that let you transfer value across separate blockchain networks that can’t natively communicate with each other.

Wormhole is one of the larger cross-chain messaging and bridge protocols. At the time of the hack, it connected Ethereum, Solana, and several other blockchains. Here’s how it works in simple terms:

• You deposit ETH into a smart contract on Ethereum. That contract locks your ETH.
• The bridge detects this deposit and issues a corresponding “wrapped” token on Solana — call it wETH (Wormhole ETH). This wrapped token is supposed to be redeemable 1:1 for the real ETH locked on Ethereum.
• When you want your ETH back, you burn the wETH on Solana, and the Ethereum-side contract releases your locked ETH.

The critical security assumption: the Solana side should only mint wrapped tokens when it receives a valid, verified authorization that real ETH was actually deposited on Ethereum. A set of trusted validators called “guardians” are supposed to sign off on this. The whole system depends on that verification being airtight.

It wasn’t.

How the Wormhole Bridge Exploit Worked

The Wormhole bridge exploit came down to a single failed check in Solana-specific code.

Solana’s programming model is different from Ethereum’s. Instead of smart contracts that hold their own data, Solana programs operate on separate “accounts” that store state. To verify signatures, Wormhole’s Solana program was supposed to check a specific system-level account — called a “sysvar” — that provides cryptographic verification services.

Here’s where it broke down: the code checked whether a sysvar account was provided, but it didn’t enforce that the account provided was actually the real, legitimate system sysvar. An attacker could pass in a fake account that looked like the right interface — and the program would accept it.

That’s what happened. The attacker crafted a fake account that mimicked the signature verification interface, passed it to the verify_signatures function, and tricked the bridge into accepting a forged authorization. With a forged “yes, ETH was deposited” message in hand, the attacker then told the Solana-side contract to mint 120,000 wETH — with absolutely zero actual ETH deposited on Ethereum.

From there, they moved quickly. The attacker redeemed 93,750 of that fabricated wETH for real ETH on the Ethereum side — draining $320 million from the Ethereum vault. The remaining wETH sat on Solana, now backed by nothing.

Total loss: approximately $320 million. Execution time: fast enough that most users didn’t notice until it was over.

This wasn’t a clever cryptographic attack. There was no breaking of encryption, no brute-forcing of private keys. It was a missing validation check — one that verified the right type of thing was present, but not that the actual thing provided was legitimate. The kind of oversight that a careful line-by-line audit of Solana-specific code might have caught.

The Unusual Aftermath: Jump Crypto Absorbs a $320M Loss

What happened next was genuinely unprecedented in DeFi history.

Wormhole is developed by Jump Crypto, the crypto arm of Jump Trading — one of the world’s largest proprietary trading firms. Within hours of the hack becoming public, Jump Crypto announced it was depositing 120,000 ETH to replenish the bridge — making every affected user whole. A private firm absorbed a $320 million loss so that a DeFi protocol wouldn’t collapse.

Why would they do that? A few reasons:

Reputational stakes. Jump Crypto had staked its reputation on Wormhole. Letting users lose $320M would have been devastating for their standing in the ecosystem.

Systemic risk. By February 2022, Wormhole was deeply integrated into Solana DeFi. Multiple protocols and substantial liquidity depended on Wormhole-wrapped assets. A collapse of Wormhole’s backing would have cascaded through the entire Solana ecosystem.

Obligations to partners. Jump Crypto had relationships with protocols that had built on Wormhole. Walking away would have burned those bridges — literally.

This outcome was good for users who had funds at risk. But it reveals something important that gets overlooked when we talk about “decentralized” finance: some DeFi protocols have an implicit backstop — a central actor with deep pockets who can and will intervene when things go wrong. Wormhole users in February 2022 were relying on that backstop whether they knew it or not.

Most DeFi protocols don’t have a Jump Crypto behind them. Most don’t have a proprietary trading firm with billions in capital ready to cover losses. For the vast majority of DeFi hacks — and there have been many — the losses are permanent. There’s no bailout. The money is simply gone.

This is why the Wormhole hack is both reassuring and alarming: it worked out, but you should not count on that being true the next time.

The Bridge Attack Pattern — and What You Can Do About It

The Wormhole hack isn’t an isolated incident. Cross-chain bridge hacks have become the single largest category of DeFi losses in aggregate. We covered the Ronin Bridge hack (Post 57) — where attackers compromised validator keys and drained $625 million — and the Poly Network hack (Post 62), where a flaw in privilege verification allowed an attacker to drain $611 million. The Nomad bridge was exploited for $190 million in August 2022. Different vulnerabilities, same attack surface.

Bridges are structurally high-risk for a few reasons:

• They hold enormous concentrated value. Unlike a DEX, which holds assets only temporarily during a swap, bridges lock assets for extended periods. That makes them an attractive target. Why rob a thousand wallets when you can rob the vault?
• They involve complex multi-chain logic. Single-chain code is hard enough to audit. Code that coordinates across Ethereum, Solana, and other chains — each with different account models, different programming paradigms, different security assumptions — is exponentially harder to get right.
• Auditors may not have cross-chain expertise. The Wormhole vulnerability was in Solana-specific code. Many security auditors specialize in Ethereum’s EVM. Solana’s account model is fundamentally different, and the gap in expertise can leave vulnerabilities unexamined.

So what can you do? If you need to use bridges, here’s how to reduce your exposure:

Minimize time spent in bridge-wrapped assets. If you’re bridging ETH to Solana for a specific purpose, do the thing, then bridge back. Don’t leave substantial assets sitting in bridge-wrapped form indefinitely. The longer your assets sit in a wrapped state, the longer they’re exposed to bridge risk.

Prefer native assets where possible. ETH on Ethereum carries no bridge risk. SOL on Solana carries no bridge risk. A native asset on its home chain is not at risk of a bridge exploit. Once you wrap it and move it, you’ve added a new layer of trust.

Use official, well-audited bridges for major chains. If you’re moving assets to Ethereum layer-2 networks like Arbitrum or Optimism, use their official bridges. The official bridges for major L2s have undergone more rigorous scrutiny than most third-party alternatives. Our practical bridging guide (Post 43) covers this in more detail.

Check the bridge’s audit history before you use it. Before bridging with any protocol, look it up on DefiLlama or a security-focused aggregator. Has it been audited? By whom? When was the last audit? Has it been exploited before? A bridge with no audit history or a history of exploits is not worth the convenience of cheaper fees.

Check for insurance coverage. Some protocols use DeFi insurance like Nexus Mutual, which can cover smart contract failures. It’s not a guarantee, but it’s a layer of protection that some users find worthwhile for larger amounts.

The Bigger Lesson: Know Your Trust Assumptions

The Wormhole hack ultimately raises a question that every DeFi user should sit with: when you use a “decentralized” protocol, do you actually know who or what you’re trusting?

The promise of DeFi is trustless, code-enforced finance — rules that execute automatically without relying on any person or institution. But the Wormhole aftermath showed that some protocols have a central actor who can and will intervene. That’s not necessarily bad. Users got their money back. But they need to know that’s the situation they’re in — and not assume it will always be true.

After the hack, Wormhole underwent more rigorous auditing, and the broader bridge security ecosystem matured. New security standards emerged, multi-party verification improved, and bug bounty programs expanded. The DeFi space tends to learn from its catastrophes — but the tuition is paid in user losses.

Understanding those trust assumptions — who holds the keys, who can intervene, who has the incentive to make you whole if something goes wrong — is one of the most important due diligence steps you can take before putting real money into any DeFi protocol.

Conclusion: The $320 Million Lesson in Bridge Risk

The Wormhole hack happened because a single missing validation check in Solana-specific code allowed an attacker to forge authorizations and mint $320 million in unbacked tokens. It was cleaned up because Jump Crypto had the capital and the motivation to make users whole — a circumstance that will not repeat itself for most DeFi hacks.

The takeaway isn’t “never use bridges.” Bridges are a real part of the crypto ecosystem, and they’ll continue to be. The takeaway is: understand what you’re using, check the audit history, minimize your exposure, and don’t assume there’s a billionaire backstop waiting to cover your losses.

Because most of the time, there isn’t.

Subscribe to Crypto Clarified — our free weekly newsletter on staying safe in crypto. We cover the hacks, the red flags, and the practical steps you can take to protect yourself — no hype, no financial advice, just clear information.