Wormhole published its own security fix — and a hacker minted $325M before it deployed

Wormhole was one of the busiest bridges between Ethereum and Solana: deposit ETH on one side, receive wrapped ETH (wETH) on the other, with deposited coins held 1:1 as escrow. On February 2, 2022, an attacker forged a valid signature for a message the bridge trusted and minted 120,000 wETH — about $325 million — without depositing anything, then cashed roughly $250 million of real Ethereum out of the bridge's collateral.

The signature-verification bug was known inside the project, and a fix had been written. But the fix was pushed to the project's public GitHub repository on the day of the attack, before it reached production. The commit was described as a routine version bump, but as developer Matthew Garrett observed, the diff was far too large for that story — and it told anyone watching exactly where the soft spot was. Hours later, it was exploited.

Wormhole announced the network was 'down for maintenance', confirmed the theft, and offered the attacker a $10 million bounty embedded in an on-chain message. The thief never took it. The next day Jump Crypto — the trading firm whose developers build Wormhole — replaced the 120,000 ETH to keep the bridge solvent, a rescue CoinDesk reported and Jump itself confirmed on Twitter.

$325M in wETH minted from nothing; about $250M drained from the bridge's Ethereum collateral; Solana fell 10% on the day

The patched code lived in a public repo while production still ran the vulnerable version — the fix itself became the exploit's instruction manual.

The commit was labelled a routine update, but its size contradicted the label, quietly advertising that a security fix was in flight.

Publishing code and running code were treated as separate acts, which on a public blockchain they can never be.

A signature check on a bridge is a single point guarding nine figures; a Neodyme audit months earlier had not caught the flaw.

A public repo is a deployment channel whether you mean it or not. If the fix exists where attackers can read it, commit and ship together — or deploy first and publish only once every node is patched.

Jump Crypto's 120,000 ETH injection kept wETH backed 1:1 and stopped contagion across Solana's DeFi lending markets, many of which used wETH as collateral. The thief was never identified and the bounty went unanswered. The breach became the canonical evidence for Vitalik Buterin's warning that cross-chain bridges face 'fundamental limits' on security, and it pushed bridge teams toward withholding fixes until deployment completes — and toward treating audits as a floor, not a ceiling.