On 2 February 2022 the Wormhole token bridge, which connects Ethereum and Solana, lost around 120,000 wrapped Ether — reported at approximately $320 million. The exploit is described as a flaw in the bridge’s signature verification, allowing the attacker to mint wrapped Ether on Solana without the backing deposit.
Jump Crypto, the digital asset arm of Jump Trading Group and owner of the bridge’s developer, replaced the missing funds. A $10 million bounty was offered to the attacker by embedding a message in a transaction. In February 2023 a counter-exploit reportedly recovered around $225 million.
The Backstop Was A Company
Users were made whole quickly, which is unusual in this corner of the corpus and worth recording plainly.
What made them whole was a trading firm’s decision to absorb $320 million to protect a product it owned. There was no insurance, no reserve fund and no protocol mechanism — the guarantee was corporate and discretionary. We filed 22-0417 and 22-0801, where no such parent existed and the losses simply stayed lost.
Minting Is Not Stealing
Nothing was taken out of a vault. The attacker persuaded the bridge to issue tokens representing deposits that had not been made, and those tokens were then real enough to exchange.
A bridge’s entire function is to assert that something on one chain is backed by something on another, and the assertion is the product. We have recorded the same category at 22-0801, where a validation default made every message provable, and at 22-0417 — the system performed its stated function on inputs it should have rejected.
Recovery A Year Later
The reported counter-exploit recovering roughly $225 million in early 2023 is a category we have no other instance of: funds retrieved by exploiting the position the attacker had taken.
The desk records it without treating it as a template. It depended on the attacker having placed the proceeds somewhere reachable by the same techniques, which is a circumstance rather than a strategy — and it arrived a year after the loss had already been absorbed by someone else.
Compiled from contemporaneous reporting and published incident analyses, listed below. Dollar values for crypto losses reflect prices at the time of reporting and move substantially; they are carried as reported rather than as settled figures. No individual or address is named. Graded high on the mechanism, which is publicly verifiable on-chain. Corrections: corrections@forensicpost.com.