The $250 Million Hack | Ethereum Solana Bridge Exploit

Transcript

oh my god so much to discuss uh largest exploit ever okay this might be a 300 million dollar exploit and it happened on a bridge the bridge hack for track yeah 300 million dollars is this 300 million i heard somewhere between 250 and 300 you know depending on the price a lot okay um i said 200 million this but um it was more and um this i maybe we'll start with kind of first off that's big that's very very big that's a big number that's the second biggest defy exploit of all time yes it is yes uh millions when you get in the hundreds of millions that's that's very big territory it's a nice bank heist yes bank guys keep getting bigger uh it's i'll start here with it's it's kind of a

prediction that i feel like bankless has has made and uh not happy about this prediction but like it felt like an inevitability in 2022 this is a tweet that i put out earlier in january sad prediction there will be some monster bridge hacks in 2022 that will make people question their multi-layer one chain thesis i feel like that's a little bit what happened right multi-chain bridge really fast it did okay and uh then i probably doubled down on that prediction which is again sad okay sadly this exploit is just the start and i feel like that's the case too although hopefully everyone with bridges is double checking their code right now to

make that sure this thing doesn't happen but we'll start there tell us actually what happened this thing is called wormhole on solana i believe give us the scoop here david yeah so this everyone's attention got raised when sam z's son who's a famous white hat hacker who can like almost like fix any exploit before everyone knows about it tweeted out that wormhole is not having a good time and it turns out by the time sam paid attention to it uh it had already it had already happened so the wormhole network which is a ethereum two solana bridge that lets you wrap up your ether on ethereum put that ether into a smart contract on ethereum and then that smart contract pings

another smart contract on solana to tell the solana chain that some ether just got deposited into it and they can mint new ether fake ether wrapped ether solana ether on the salon chain and the reason why that will have value is because you can go back and forth and that's how bridges work uh what happened allegedly uh from what we are uh understanding from all the people that know how to code and uncover these things is that the smart contract on the solana side had an exploit that allowed the exploiter to mint uh a bunch of solana ether a bunch of ious for ether on the ethereum chain that was and and so they just minted new ones uh kind of in the same way that federal reserve prints new

money if you can get a hold of the money printer you can print a bunch of new monies but that doesn't mean that there's actually more ether backing it on the ethereum chain so the exploiter minted a bunch of solana ether and then sent that salon ether back through the bridge so that they could take the ether on the ethereum side out of this out of the wormhole smart contract and that came out to a tune of 120 000 wrapped ether and then that 120 000 wrapped ether is now in the exporter's wallet and i don't know if they're actually watching it through tornado cache yet um but i would imagine that's just kind of the only way that they can get that value cleaned this happened as we're recording it this happened i don't know 12 hours before we're recording this maybe maybe a bit more so the story the

story and what's happening is kind of still developing as we're doing it but yeah exactly what you said right so you've got these fake ious on solana and then the hacker just caches these ious for real eth on the ethereum side of things but this causes some downstream effects doesn't it what are the downstream effects the cascade of effects when something like this happens right so ether is fantastic collateral and so is used as collateral and liquidity inside of solana defy and so all of a sudden the ether collateral in these defy applications like providing liquidity to other tokens uh becomes unbacked and so it kind of goes from like an iou to ether to an iou of

nothing uh and so all of a sudden like the value in these things just evaporates right because it's like if somebody if somebody like stole all the gold out of a bank that had issued ious against that gold well if there's some gold there like you can't issue any ious for it or the ious that you do have are worthless and so it has cascading impacts on defy liquidations happen because if um a value of the collateral goes to zero then like people need to get liquidated but also how can you liquidate anything if there's no actual value there like you the ious aren't worth anything and so it really just it just messes up everything it's a it's a systemic risk to have uh all of this unbacked collateral in in in solana defy uh and so

like uh this is exactly this uh giorgio's constantinopolis from paradigm says domino effect of now under cloud uncollateralized loans against wormhole eth is severely undermentioned that was yesterday uh this has been fixed actually uh as of like literally one or two hours before recording uh somebody uh we think jump capital has foot footed the bill foot footed footed footed the bill uh i have a hundred put the they they coughed up in all the ether and so now the wormhole bridge is actually whole again because uh we think drum capital coughed up is it jump capital i think so that's what everyone is that's still developing that's unconfirmed but that's that's kind of the only people that we can really consider to have this much

money 250 million dollars just like okay here like we'll we'll make wormhole whole again uh absolutely crazy um yeah so so basically we had all of these uh ious that were minted this causes a cascade of problems everywhere this wrapped ether on salon and the solana defy ecosystem is used right because now all of these assets that you thought were backed by eth are no longer backed right so it's a lot of problem all the while wormhole is saying hey look guys we got this like they were tweeting out we're we're finding a way to restore funds in the background they were negotiating with the hacker i believe and they sent messages to the hacker saying hey if you just return

the funds we'll give you 10 million dollars you'll be a white hat right you'll be helping us out for the 10 million bug bounty yeah yeah and who knows there's probably lots of other conversations that we're not not privy to right and so um but now what's just developed it seems like and what you're saying david is uh wormhole is back up they somehow procured the funds amazing and you think it was this was from uh jump capital that's what that funded this yeah so jeff garcia asked that question where uh where did the uh funds to refill the bridge come from uh and so if you click on that tweet and then scroll down you'll see a lot of speculation that it was jump capital um jump is covering because they believe in the future of crypto and what they're

building so jump capital i think maybe had some like um maybe were there investors in wormhole or or something like that um jump capital is it's a trading desk i think and they just print money from doing trading stuff so they're very well capitalized obviously but i mean they could pay for this if they wanted to at the end of the day 250 million dollars is nothing i'm sorry even uh george soros will will notice 250 million dollars missing from his treasury i think yeah that's that's incredible um you know i guess i guess so that you know what do we learn from this episode here there's maybe some lessons that are starting to emerge uh i feel like the first thing we're learning is that

bridges are dangerous bridges are dangerous um and they're dangerous they're dangerous in two ways they're dangerous in one the smart contract code for a bridge can actually be hacked and that's what happened here there's a smart contract code hack which happened on the solana side which ryan is is differentiating from the bridge it's like so yeah you have that you have the bridge that spans two endpoints two structures and the bridge can break and be broken in the middle or the two structures on the end can also break and those are the smart contracts on either side of the bridge so the bridge was fine because even that even the exploiter was able to transfer assets across the bridge it was the entryways of the bridge that got exploited here and these are each

individually uh weak points and we've seen hacks like this not for a bridge but like this in d5 uh many different times right you know the famous parody multi-sick hack is you know smart contract code that is basically hacked so that's the first category the other category that we haven't yet seen but vitalik has been talking about um for for a while and particularly for the last month is economic attacks so this is like you're sort of dependent on the multi-sig signers or you're dependent on the security of um you know the solana chain or any side chain to actually secure this bridge and that's another iceberg i think under the water a little bit that people aren't seeing um you know from my perspective it's good that people are paying more

attention to bridge security so there is a uh i guess a a sunny side at the like at the other side of this um i think it's important to note that both layer ones like this bridge layer ones like this and layer two bridges can have the smart contract vulnerability though they probably don't layer twos don't have the same economic attack uh surface area that these layer one bridges have so i'm happy to see that bridge security is coming into focus it seems like it's good that there's a happy ending where maybe a big capital provider like jump is um reimbursing all funds um i do think that look this bridge was talked about as if

it was you know safe and secure and i think a lot of people thought it was safe and secure and i think there is some troubling i guess market pressure for everyone to say their bridge is secure when it's really not and that is troubling and i hope we we we see the lessons of of security from this and we take those lessons and we apply them and we look at these bridges with a lot more scrutiny moving forward what do you think the takeaways are david my the biggest thing i'm surprised about is i had no idea how much ether was on solana via this wormhole like a quarter billion dollars is a lot over a hundred thousand a hundred thousand units of ether is a

lot reminder there's 118 million uh ether in existence a lot of that's locked a lot of that is lost so maybe like you know 10 to 15 million of that is actually lost somehow somewhere um but like a hundred over a hundred thousand ether is a lot like that is not trivial um and so that's what i'm surprised about i'm i'm surprised that a bridge in such a nascent part of bridging's like story with crypto had that much ether wrapped up in his contracts um and it go it also like whenever um solana goes down like uh we have kyle simani and anatoly come out and say like a main beta salon is in mainnet beta like you know we got ddos it's going down

i'm sorry what kind of mainnet beta has a quarter billion dollars of value in it like we need to pick we need to pick a lane guys uh is this is this a beta or is this a live ecosystem because if people are getting liquidated it's not really a beta um they are very very the whole salon ecosystem is very very fortunate that jump has the means and the reason and the ability to actually cover the losses here um part of me wonder if we we get the wrong lesson out of this as well like i'm glad that um users are going to be made whole for this i think that's a great thing and i'm you know i'm happy individually but i feel like it's a dangerous precedent for bridge users to expect that any hack or economic attack is going to get

bailed out in the future because just because this ended with a happy ending doesn't mean the next one will you know there's not necessarily a jump capital who's going to like step in and reimburse everyone um and so especially when these bridges and layer twos and everything decentralize like there's not there's supposed to be no one there exactly so there's there's some brittleness in this structure that we're building in particular in the bridging structure i think we talked a lot about this with roon christensen on the episode that we did with him uh so go check that out that's somewhere in the archives as well uh and uh yeah bridges are gonna be a main topic of discussion this won't be the last hack that we see of 2022 sadly

uh and uh yeah we're gonna we're gonna continue talking about it um so um what is this exporter gonna do with all the money what does one do with 250 million well okay so they can't touch usdc they can't touch usdt they'll get frozen because it'll get frozen so like they can touch die if they want you're going straight to eat yeah and then you're going to tornado cash yeah right but like you can't you can't just wash a hundred thousand units of ether through tornado cash like you can maybe do like a couple hundred each a week but like if you you have to pull it out into different wallets you can't you because but then also like sure you can

you can start to liquidate like the the trickle of each that you push through tornado cash so yeah you hack you exploit something for a quarter billion dollars and then maybe over the course of one year you can discreetly withdraw one million dollars across like you know spreading it out and obfuscating and you just wait a long time yeah exactly just wait a long time but like what the hell do you do with the remaining 249 million dollars you just keep it neath you take out some loans use it in defy i don't know that's an option to do what if you can't do it where does it it's stuck there yeah i guess it is although like i think a lot more will be built like you could just um expect that there'll be more privacy preserving solutions in the

future more off-ramps this sort of thing on your hands and so you can get your money if they're if they're inside the united states like they where are they gonna how are they gonna tell the irs that where they got their quarter billion dollars from oh there i don't i it's very dif it's going to be very difficult for them to exit that's why if i am the hacker i'm pretty like i'd be pretty tempted to be like oh okay yeah no this just a prank guys look i'm a white house just a prank i'm it's i'm a white hat because because they offered that exploiter 10 million dollars i'll take the 10 million free and clear right and but i'll although i do wonder is that really free and clear you know you hack something can you just be like yeah

yeah can you like remove yourself from all like courts and abilities yeah just by just taking the 10 million bribe to give it all back yeah or maybe maybe you're supposed to play koi and pretend that you were just a white hat all along maybe that's the way to do it and maybe that makes it free and clear i don't know look i'm not a hacker okay david do you want to interview a hacker yeah yo if a hacker wants to come on bank list let me know i will throw you a zoom link we're just curious we're just kidding yeah any hackers what are you going to do with the money that's all i want to know i just want to know what you're going to do with the money yeah dm me hey we hope you enjoyed the video if you did head over to bankless hq right now

to develop your crypto investing skills and learn how to free yourself from banks and gain your financial independence we recommend joining our daily newsletter podcast and community as a bankless premium subscriber to get the most out of your bankless experience you'll get access to our market analysis our alpha leaks and exclusive content and even the bankless token for airdrops raffles and unlocks if you're interested in crypto the bankless community is where you want to be click the link in the description to become a bankless premium subscriber today also don't forget to subscribe to the channel for in-depth interviews with industry leaders ask me anythings and weekly rollups where we summarize the week in crypto and other fantastic content

thanks everyone for watching and being on the journey as we build out the bankless nation