4 ms·

How does that work? If the money was moved to ETH, how did they restore the funds?

by cheeze 5y ago

Kranar 5y ago
My speculation on this is that such a failure is catastrophic enough to destroy an entire blockchain. Solana has made billionaires out of a small group of people and they'd much rather fork over the 300 million dollars to plug this hole so as to preserve the remainder of their wealth, instead of having Solana crash to become worthless. While in principle a bug like this could have happened on Ethereum, or any programmable blockchain platform, ultimately this attack happened on the Solana blockchain and is an attack on Solana. The people who have a vested interest in seeing Solana survive will have coughed up the funds. Finally, it's worth keeping in mind that while failures like these become very public and it seems like cryptocurrencies are always doing nothing but crashing, failing, and losing money, there are also plenty of people making millions and even billions of dollars a year offering crypto related services. To those folks 300 million dollars, while not trivial by any means is also not the end of the world if it will allow them to continue operating.
- vmception 5y ago
  Also noteworthy is that bridge technology is what allows these chains to have immediate utility to the market faster. Centralized Exchanges are extremely slow in listing new blockchains, especially meta assets on those blockchains. For example, want USDC on Solana? Sorry even if your exchange listed Solana and allow for withdrawal of native SOL, they aren't allowing withdrawals of tokens to the Solana network. They dont know, don't care, don't have the development resources to prioritize that, aren't even familiar with a erc-20 standard of tokens yet, and legal hasn't gotten the rubber stamp from the New York Department of Financial Services anyway so why bother catering to the rest of the world.. Whereas the permissionless bridges plug in immediately and billions of dollars of assets can move in without bothering with a centralized exchange. Building starts immediately, forget about the permits. So, private participants fixing a crucial bridge is the rational move.
  - wmf 5y ago
    I was wondering how a bridge could hope to earn back $300M in fees in any reasonable horizon, but if we view Wormhole as a loss leader to pump the overall Solana ecosystem (which I guess Jump is invested in) it makes sense.
  - dboreham 5y ago
    Also noteworthy: this kind of "trusted" bridge architecture is probably now doomed.
    - vmception 5y ago
      I don't get that impression. It's patched and more resilient now, the exploit occurred with someone watching the github about the patch, or even more likely it was someone on the dev team/discussion about why the patch was needed. The "guardians" are still there and distributed. I don't see more distributed bridge styles being real competitors at least to Wormhole on the Solana network. Individual users didn't lose funds and their exposure is always limited to a few minutes.
- oblio 5y ago
  Didn't they do the unthinkable a few years back, for Ethereum itself? They forked the immutable database because of a bug or exploit, I forget what it was exactly. Similar story, rich people protecting their assets.
  - rvz 5y ago
    The failure of the first DAO for Ethereum in 2016 is what you are talking about. [0] Its a similar story, but this time no individual at the top reversing the whole blockchain of that transaction and hard forking it to cause a revoult against the main blockchain or a new group creating something like Solana Classic, etc. whilst talking about 'code is law'. At least this is indeed 'Code is law'. [0] https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization)
  - roland35 5y ago
    Yup, it was called "the dao" and a hacker ran away with a third of their Ethereum. https://en.m.wikipedia.org/wiki/The_DAO_(organization) https://en.m.wikipedia.org/wiki/The_DAO_(organization)
WJW 5y ago
It's not the original funds that were restored; one of the hedge funds behind Wormhole put in an extra $320 million to balance the books again. The hackers still have the original $320 million.
ww520 5y ago
Guessing from the available information, Wormhole works by having a pile of ETH in its account, a piles of wETH tokens backed 1-to-1 by the ETH in the account, and piles of other types of tokens, like Solana. When the wETH coins are initially set up, there's a way to deposit the initial ETH tokens into the Wormhole's ETH account to jump start the whole process. When a user wants to convert Solana to ETH, he deposits the Solana tokens to the Wormhole smart contract and it issues the wETH tokens at some exchange rate, taking a 1-1 ETH from Wormhole's ETH account, tying the Solana and the ETH in the wETH tokens. After the dust is settled, the user can convert the wETH tokens to ETH. The Solana tokens held in the wETH tokens are deposited in Wormhole's Solana account, the ETH tokens held in the wETH tokens are released to the user. Everything is good. The hack was to create a bunch of Solana based wETH tokens out of the thin air, exploiting a bug in teh Wormhole smart contract. The hackers forced a settling of the fake wETH tokens against Wormhole's ETH account, taking the ETH away. In the process, leaving whole bunch garbage Solana tokens in Wormhole's Solana account. Now Wormhole's ETH account is down by $320M. Whatever wETH tokens floating out there have no 1-1 backing from the ETH account. The whole thing can collapse with a bank run. They fixed it by depositing $320M ETH tokens into the Wormhole's ETH account to ensure the fake wETH tokens are backed as well. The fake Solana tokens are still in their account. It's basically they're using $320M ETH tokens to buy a bunch of Solana tokens, which the hackers created. So at the end, they're not really out of $320M money; they still have the $320M Solana tokens, fake or not. It's just the general public got screwed by having $320M of Solana tokens inflated on them.

How does that work? If the money was moved to ETH, how did they restore the funds?

by cheeze 5y ago

How does that work? If the money was moved to ETH, how did they restore the funds?

My speculation on this is that such a failure is catastrophic enough to destroy an entire blockchain. Solana has made billionaires out of a small group of people and they'd much rather fork over the 300 million dollars to plug this hole so as to preserve the remainder of their wealth, instead of having Solana crash to become worthless. While in principle a bug like this could have happened on Ethereum, or any programmable blockchain platform, ultimately this attack happened on the Solana blockchain and is an attack on Solana. The people who have a vested interest in seeing Solana survive will have coughed up the funds. Finally, it's worth keeping in mind that while failures like these become very public and it seems like cryptocurrencies are always doing nothing but crashing, failing, and losing money, there are also plenty of people making millions and even billions of dollars a year offering crypto related services. To those folks 300 million dollars, while not trivial by any means is also not the end of the world if it will allow them to continue operating.

vmception 5y ago
Also noteworthy is that bridge technology is what allows these chains to have immediate utility to the market faster. Centralized Exchanges are extremely slow in listing new blockchains, especially meta assets on those blockchains. For example, want USDC on Solana? Sorry even if your exchange listed Solana and allow for withdrawal of native SOL, they aren't allowing withdrawals of tokens to the Solana network. They dont know, don't care, don't have the development resources to prioritize that, aren't even familiar with a erc-20 standard of tokens yet, and legal hasn't gotten the rubber stamp from the New York Department of Financial Services anyway so why bother catering to the rest of the world.. Whereas the permissionless bridges plug in immediately and billions of dollars of assets can move in without bothering with a centralized exchange. Building starts immediately, forget about the permits. So, private participants fixing a crucial bridge is the rational move.
- wmf 5y ago
  I was wondering how a bridge could hope to earn back $300M in fees in any reasonable horizon, but if we view Wormhole as a loss leader to pump the overall Solana ecosystem (which I guess Jump is invested in) it makes sense.
- dboreham 5y ago
  Also noteworthy: this kind of "trusted" bridge architecture is probably now doomed.
  - vmception 5y ago
    I don't get that impression. It's patched and more resilient now, the exploit occurred with someone watching the github about the patch, or even more likely it was someone on the dev team/discussion about why the patch was needed. The "guardians" are still there and distributed. I don't see more distributed bridge styles being real competitors at least to Wormhole on the Solana network. Individual users didn't lose funds and their exposure is always limited to a few minutes.
oblio 5y ago
Didn't they do the unthinkable a few years back, for Ethereum itself? They forked the immutable database because of a bug or exploit, I forget what it was exactly. Similar story, rich people protecting their assets.
- rvz 5y ago
  The failure of the first DAO for Ethereum in 2016 is what you are talking about. [0] Its a similar story, but this time no individual at the top reversing the whole blockchain of that transaction and hard forking it to cause a revoult against the main blockchain or a new group creating something like Solana Classic, etc. whilst talking about 'code is law'. At least this is indeed 'Code is law'. [0] https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization)
- roland35 5y ago
  Yup, it was called "the dao" and a hacker ran away with a third of their Ethereum. https://en.m.wikipedia.org/wiki/The_DAO_(organization) https://en.m.wikipedia.org/wiki/The_DAO_(organization)

WJW 5y ago

It's not the original funds that were restored; one of the hedge funds behind Wormhole put in an extra $320 million to balance the books again. The hackers still have the original $320 million.

ww520 5y ago

Guessing from the available information, Wormhole works by having a pile of ETH in its account, a piles of wETH tokens backed 1-to-1 by the ETH in the account, and piles of other types of tokens, like Solana. When the wETH coins are initially set up, there's a way to deposit the initial ETH tokens into the Wormhole's ETH account to jump start the whole process. When a user wants to convert Solana to ETH, he deposits the Solana tokens to the Wormhole smart contract and it issues the wETH tokens at some exchange rate, taking a 1-1 ETH from Wormhole's ETH account, tying the Solana and the ETH in the wETH tokens. After the dust is settled, the user can convert the wETH tokens to ETH. The Solana tokens held in the wETH tokens are deposited in Wormhole's Solana account, the ETH tokens held in the wETH tokens are released to the user. Everything is good. The hack was to create a bunch of Solana based wETH tokens out of the thin air, exploiting a bug in teh Wormhole smart contract. The hackers forced a settling of the fake wETH tokens against Wormhole's ETH account, taking the ETH away. In the process, leaving whole bunch garbage Solana tokens in Wormhole's Solana account. Now Wormhole's ETH account is down by $320M. Whatever wETH tokens floating out there have no 1-1 backing from the ETH account. The whole thing can collapse with a bank run. They fixed it by depositing $320M ETH tokens into the Wormhole's ETH account to ensure the fake wETH tokens are backed as well. The fake Solana tokens are still in their account. It's basically they're using $320M ETH tokens to buy a bunch of Solana tokens, which the hackers created. So at the end, they're not really out of $320M money; they still have the $320M Solana tokens, fake or not. It's just the general public got screwed by having $320M of Solana tokens inflated on them.