Wormhole: the $326M shortcut past the guardians
Wormhole's Solana bridge verified messages with a 13-of-19 'guardian' signature check. The catch: the program did not do the expensive signature math itself - it read the result from a prior instruction in the same transaction, trusting the system-provided 'instructions' account. The attacker passed a fake version of that account, filled it with a forged 'signatures are valid' instruction, and the program believed the guardians had approved a 120,000 ETH deposit that never happened. It minted 120,000 wETH from nothing, then bridged it to Ethereum. No key was stolen. The program simply verified the wrong thing.
Wormhole is a bridge - infrastructure that lets assets travel between blockchains that otherwise cannot talk to each other. This case is about the Solana <-> Ethereum path, but the same design secures many chains.
It lets you 'move' value across chains. If you want to use your ETH on Solana, you lock your real ETH in the bridge on Ethereum and receive a wrapped token (wETH) on Solana that is meant to be backed 1:1. Later you can burn the wETH and unlock your real ETH. No ETH is ever teleported - it is locked on one side and a claim is minted on the other.
A bridge must decide when it is safe to mint the wrapped token on the far side. Wormhole used 'guardians' - 19 independent validators who watch the chains and sign a message (called a VAA) that says 'we really saw this deposit.' On the destination chain, the bridge checks that at least 13 of those 19 signatures are genuine. If enough are, it trusts the message and mints.
Everything rests on that signature check being real. If an attacker can make the chain believe '13 guardians approved this deposit,' the bridge will happily mint wrapped tokens for a deposit that never happened - creating value out of thin air. That single check is what the attacker broke.
A bridge moves value between chains by locking an asset on one side and minting a wrapped claim on the other. The critical question is: who is allowed to say 'the asset really was locked'?
Wormhole answered with guardians: 19 validators who sign a message (a VAA) attesting to a deposit. On the destination chain, the program checks that at least 13 of the 19 signatures are valid. If they are, it mints the wrapped token.
The shortcut that broke it:
1. Elliptic-curve signature checks are expensive, so Wormhole did not run the curve math inside the bridge program. Instead, the transaction includes a separate instruction to Solana's native secp256k1 precompile that verifies the signatures, and verify_signatures reads the result of that earlier instruction from the 'instructions' sysvar account.
2. To find that earlier instruction, the code called load_instruction_at - the deprecated, unchecked version. It trusted whatever account was passed as the instructions sysvar by address, never verifying who owned it.
3. The attacker passed their own account in place of the real sysvar, containing a fake 'secp256k1 verified these signatures' instruction. verify_signatures read the forgery and accepted it as the guardians' approval.
4. Wormhole then accepted an attacker-authored VAA claiming 120,000 ETH had been deposited on Ethereum - a transfer that never occurred - and minted 120,000 wETH on Solana.
5. The attacker bridged 93,750 ETH out to Ethereum via the bridge's legitimate path.
The fix - shipped the same day - replaced load_instruction_at with load_instruction_at_checked, which verifies the account's owner is the System Program before trusting it. One line. The difference between a trustworthy signature and a forged one.
You are the detective. Someone moved money that was not theirs, and all you have is a public blockchain and a few free websites. The five moves below are the same routine professional investigators run on almost any exploit - bridges, oracles, rug pulls. No coding required, just curiosity.
Start with the claim, not the conclusion. 'A bridge lost $326M' tells you almost nothing. Pin down WHAT moved, WHEN, and WHICH address touched it - then ask the real question: who was supposed to authorize that move?
Do thisOpen the bridge's official statement next to the Solana explorer. Write down the exact date/time in UTC, the asset, and the chain(s) involved.
Look forThe one word that reframes everything. Here it was 'minted'. A bridge can only mint a wrapped token against a real deposit - so the whole case becomes: who faked the deposit?
In this caseWormhole, February 2 2022. The 120,000 wETH (~$326M) was MINTED on Solana - not stolen from a wallet. That one word points straight at the bridge's verification logic.
Wormhole X postSolscan
The attacker deposits a small amount (~0.1 ETH) to make the activity look legitimate, then submits the crafted transaction: a fake secp256k1 instruction plus a spoofed instructions-sysvar account.
A forged VAA is accepted as guardian-approved, and 120,000 wETH is minted on Solana to the attacker. Wormhole's security model never noticed.
The attacker bridges the minted wETH back to Ethereum - ~10,000 ETH within minutes, then a further ~80,000 ETH. Roughly 93,750 ETH total left the bridge before it was halted.
Wormhole confirms the exploit publicly ('the wormhole network was exploited for 120k wETH') and takes the bridge down for maintenance.
The vulnerability is patched - `load_instruction_at` is replaced with the checked variant that validates the sysvar account's owner.
Wormhole sends an on-chain message to the attacker offering a $10M 'whitehat' bounty to return the funds. It is not accepted.
Jump Crypto, Wormhole's parent, deposits 120,000 ETH from its own treasury to back the mint 1:1. The bridge is restored and every wETH holder is made whole.
The attacker has never been publicly identified and the funds were never returned.
Signature verification was delegated to a separate instruction and read via the *unchecked* `load_instruction_at`, which trusts the sysvar account by address.
The bridge never validated that the instructions account was owned by the System Program - the single check that would have stopped the attack.
One unchecked sysvar read gated the mint of effectively unlimited value - no cap, no secondary confirmation.
Cross-chain verification is inherently complex, and the code had not been adversarially tested against malformed/spoofed proof inputs.
The whole security model assumed honest inputs; an attacker fully controls the transaction they submit.
Replay the attack
Forge a guardian signature on Wormhole Token Bridge
A bridge should require 13-of-19 guardian signatures before it mints. Break that check by lying about the one account it trusted - then toggle the patch that fixed it. 100% simulated.
A bridge mints wrapped tokens on chain B only when it trusts a message saying "the asset really was locked on chain A". Wormhole Token Bridge trusts 19 guardians and requires 13 signatures. The expensive curve math happens in a separate instruction - the bridge just reads the result.