Blockchain transaction history shows that the hacker transferred the funds onto a DEX and then went on to cycle funds around different DeFi protocols.
The hacker behind the $321 million Wormhole bridge attack has shifted a large chunk of stolen funds, with transaction data showing that $155 million worth of Ether
$1,635
was transferred to a decentralized exchange (DEX) on Jan 23.
The Wormhole hack was the third largest crypto hack in 2022, after the protocol’s token bridge suffered an exploit on Feb. 2, 2022, that resulted in the loss of 120,000 Wrapped ETH (wETH) around worth $321 million.
According to the transaction history of the hacker’s alleged wallet address, the latest activity shows that 95,630 ETH was sent to the OpenOcean DEX and then subsequently converted into ETH-pegged assets such as Lido Finance’s staked ETH (stETH) and wrapped staked (wstETH).
Digging into the transaction history further, crypto community members such as @spreekaway also highlighted that the hacker went on to conduct a slew of odd looking transactions.
For example, the hacker used their stETH holdings as collateral to borrow 13 million worth of the DAI stablecoin, before swapping it out for more stETH, wrapping into stETH again and then borrowing some more DAI.
Notably, the Wormhole team has taken the opportunity to once again offer the hacker a bounty of $10 million if they return all the funds, after it left an embedded message conveying such in a transaction via the Wormhole: Deployer.
The hacker’s hefty ETH transaction appears to have had a direct impact on the price of stETH according to data from Dune Analytics. The asset’s price went from slightly under peg of 0.9962 ETH on Jan. 23, to as high as 1.0002 ETH the following day, before dropping back to 0.9981 at the time of writing.
Related: North Korea’s Lazarus Group masterminded $100M Harmony hack: FBI confirms
With the Wormhole hack likely to catch more attention in light of the latest incident, blockchain security firms such as Ancilia, Inc. warned on Jan. 19 that searching the keywords “Wormhole Bridge” in Google is currently showing promoted ad websites that are actually phishing operations.
