Wormhole Attacker Moves $155 Million of Stolen Funds into Staked Ethereum (stETH)

The attacker behind the February 2022 Wormhole exploit has moved $155 million, converting the funds to staked Ether.

A giant desert worm symbolizing Wormhole attacking.

A cryptocurrency wallet linked to the Wormhole token bridge attack has been spotted moving over $155 million worth of stolen funds for the first time in months in trades involving staked Ether.

Wormhole Attacker Moves $155 Million

In February 2022, Wormhole fell victim to one of crypto’s biggest hacks, as $321 million was stolen from the network bridge. On Monday, January 23rd, the attacker moved $155 million worth of Ether (ETH) from the stolen funds.


On-chain data shows that the attacker moved 95,630 ETH to OpenOcean, a decentralized exchange (DEX). The attacker then converted the ETH into staked Ether (stETH) and wrapped staked Ether (wstETH).

In a baffling move, the hacker used the wrapped staked Ether as collateral for a $13 million loan in the DAI stablecoin. They then used the DAI to buy more staked Ether and repeated the trades.

Wormhole and stETH React to Fund Activity

The movement of funds from the hacker comes after months of inactivity. On spotting the activity on the wallet, the Wormhole team re-offered the hacker a bounty of $10 million if they return all the funds.


The large amount of stETH moved caused a significant price movement. The asset’s value rose from 0.9962 ETH on January 23rd, to as high as 1.0002 ETH, before dropping back to 0.9981 at the time of writing.

  • Blockchain security firm Ancilia Inc. has warned that websites appearing when “Wormhole Bridge” is searched in Google are used for phishing operations.

Why You Should Care

Despite being the third largest hack in 2022, the crypto division of Jump Trading, a leading backer of the Wormhole bridge, refunded the $321 million stolen.

The details of the Wormhole exploit are contained in:
Wormhole Suffers Second-Biggest Hack in DeFi, $320 Million in wETH Stolen

The replacement of funds by Jump Trading is covered in:
Wormhole’s Parent Company, Jump Trading, Replaces the $320 Million Lost to Hack

This article is for information purposes only and should not be considered trading or investment advice. Nothing herein shall be construed as financial, legal, or tax advice. Trading forex, cryptocurrencies, and CFDs pose a considerable risk of loss.

Milko Trajcevski

Milko Trajcevski is a DailyCoin news reporter, mainly focused on Ethereum (ETH), Cardano (ADA), and their founders (Vitalik Buterin and Charles Hoskinson). Milko is an avid follower of crypto and blockchain technology and has written thousands of articles on the subjects. He finds joy in transforming complex issues into written content that anyone can understand. Milko has used and analyzed numerous exchanges, such as Coinbase, FTX, and Binance. He also closely follows all of the latest news around the largest decentralized exchanges (DEXs). Location: Skopje, Macedonia