Wormhole Hacker Moves $155M in the Biggest Shift of Stolen Funds in Months

• Wormhole Hacker Moves $155M in the Biggest Shift of Stolen Funds in Months

The blockchain transaction history demonstrates that the hacker transferred the funds to a DEX and subsequently cycled the funds through various DeFi protocols.

The hacker responsible for the $321 million Wormhole bridge breach has transferred a major portion of the stolen assets, with transaction data revealing that $155 million in Ether was transferred to a decentralized exchange (DEX) on January 23.

Wormhole was the third greatest crypto attack of 2022, after the protocol’s token bridge was compromised on February 2, 2022, resulting in the theft of 120,000 Wrapped ETH (wETH) valued $321 million.

According to the alleged hacker’s wallet address’s transaction history, the most recent activity suggests that 95,630 ETH was delivered to the OpenOcean DEX and then transformed into ETH-pegged assets such as Lido Finance’s staked ETH (stETH) and wrapped staked ETH (wsETH) (wstETH).

Digging deeper into the transaction history, crypto community members such as @spreekaway noted that the hacker went on to undertake a spate of strange activities.

For example, the hacker utilized their stETH holdings as collateral to borrow 13 million DAI stablecoins before exchanging them for additional stETH, wrapping them into stETH again, and borrowing some more DAI.

Notably, the Wormhole team has taken use of the chance to give the hacker a $10 million bounty if they return all of the funds, after leaving an embedded note indicating such in a transaction through the Wormhole: Deployer.

According to Dune Analytics data, the hacker’s large ETH transaction looks to have had a direct impact on the price of stETH. The asset’s price rose from 0.9962 ETH on Jan. 23 to as high as 1.0002 ETH the next day, before falling down to 0.9981 at the time of writing.

With the Wormhole hack expected to garner even more attention in light of the latest occurrence, blockchain security organizations such as Ancilia, Inc. cautioned on Jan. 19 that searching the phrases “Wormhole Bridge” in Google is now displaying promoted ad websites that are essentially phishing operations.

The community has been warned to be cautious about what they click on while searching for this phrase.