Jump Crypto and Oasis.app counter exploits Wormhole hacker for $225M

The asset retrieval came after the High Court of England and Wales ordered Oasis.app to work with Jump Crypto to recover the stolen funds. 5691 Total views 29 Total shares Listen to article 0:00 News Own this piece of history

Collect this article as an NFT Web3 infrastructure firm Jump Crypto and decentralized finance (DeFi) platform Oasis.app have conducted a counter exploit on the Wormhole protocol hacker, with the duo clawing back $225 million of digital assets and transferring them to a safe wallet.

The Wormhole attack occurred in February 2022, with roughly $321 million worth of wrapped ETH (wETH) exploited via a vulnerability in the protocols token bridge.

The hacker has since moved the stolen funds through various Ethereum-based decentralized applications (DApps), such as Oasis, which recently opened up wrapped stETH (wstETH) and Rocket Pool ETH (RETH) vaults.

In a Feb. 24 blog post, the Oasis.app team confirmed that a counter exploit had taken place, outlining that it had received an order from the High Court of England and Wales to retrieve certain assets related to the address associated with the Wormhole Exploit.

The team stated that the retrieval was initiated via the Oasis Multisig and a court-authorized third party, which was identified as Jump Crypto in a preceding report from Blockworks Research.

Both vaults’ transaction history indicates that Oasis moved 120,695 wsETH and 3,213 rETH on Feb. 21 and placed in wallets under Jump Cryptos control. The hacker also had around $78 million debt in MakerDAOs Dai (DAI) stablecoin, which was retrieved.

We can also confirm the assets were immediately passed onto a wallet controlled by the authorized third party, as required by the court order. We retain no control or access to these assets, the blog post reads. @spreekaway tweet on the counter exploit. Source: Twitter

Referencing the negative implications of Oasis being able to retrieve crypto assets from its user vaults, the team emphasized that it was only possible due to a previously unknown vulnerability in the design of the admin multisig access.

Related:DeFi security: How trustless bridges can help protect users

The post stated that such a vulnerability was highlighted by white hat hackers earlier this month.

We stress that this access was there with the sole intention to protect user assets in the event of any potential attack, and would have allowed us to move quickly to patch any vulnerability disclosed to us. It should be noted that at no point, in the past or present, have user assets been at risk of being accessed by any unauthorized party.

pic.twitter.com/NX1fclJs5V foobar (@0xfoobar) February 24, 2023 #Hackers #Hacks #DeFi #MakerDAO

Add reaction

Add reaction Related News What is Solana (SOL) Pay, and how does it work? Platypus attack exploited incorrect ordering of code, auditor claims Platypus to work on compensation plan after $8.5M attack Hope Finance exploit results in $2M stolen from users funds Platypus reveals compensation plan for users funds after attack