Recovery of Funds from the Wormhole Hacker Incident: Jump Crypto and Oasis Join Forces

In February 2022, the Wormhole cross-chain bridge experienced a major security incident, with approximately 120,000 ETH stolen, worth $325 million at the time. This became one of the largest thefts of crypto assets in 2022. After the incident, Jump Crypto immediately injected 120,000 ETH into Wormhole to cover the losses, while also promising to continue supporting the development of Wormhole.

Despite Wormhole offering a $10 million bug bounty and a white-hat agreement to the hacker in exchange for the return of funds, it was unsuccessful. Dave Olsen, President and Chief Information Officer of Jump Trading Group, stated a month after the incident that they are closely cooperating with government and private resources and are prepared for a long-term pursuit.

After nearly a year of effort, Jump Crypto seems to have finally made a breakthrough. According to on-chain analysis, the stolen funds were successfully recovered three days ago. This operation was completed in collaboration with Oasis, a decentralized finance platform, where they executed a counter-attack on an upgradeable Oasis contract to retrieve the stolen funds from the hacker's vault.

The hacker had been continuously transferring stolen funds through various Ethereum applications. Recently, they also opened two Oasis vaults and established leveraged long positions targeting ETH staking derivatives. Both vaults utilized the automated services provided by Oasis, creating opportunities for recovering funds.

The recovery process involves multiple wallet addresses, including Oasis's multi-signature address, fund holding addresses, and the sending address used for executing the counterattack. The counterattack was launched on February 21 and mainly involved deceiving the Oasis contract to transfer collateral and debts from the hacker's vault to the vault of the sending address.

Subsequently, a wallet believed to belong to Jump Crypto transferred 80 million DAI to the sending address to repay treasury debts and withdrew collateral worth $218 million. Ultimately, the recovered collateral was transferred to the current holding address.

Considering the DAI paid for debt repayment, the net return from this counterattack is approximately $140 million. Although Jump Crypto and Oasis have not made any formal comments on the matter, Oasis issued a statement afterwards stating that they acted based on an enforcement order from the High Court of England and Wales.

This incident once again highlights the importance of cross-chain bridge security, while also demonstrating how the transparency of blockchain can serve as a powerful tool in combating financial crime. Although this action may spark discussions about the ethics and legality of counterattacks, it at least allowed Jump Crypto to successfully recover most of the losses.

For hackers, missing the previous opportunity of a $10 million bounty and "get out of jail free card" is undoubtedly a huge lesson. This incident has also sounded the alarm for the entire crypto industry, reminding all parties to pay high attention to security issues while pursuing innovation.