Jon Rice

Dan Smith

In what appears to be the result of a coordinated effort between Jump Crypto and Oasis, the exploiter behind the infamous Wormhole attack of February 2022… has become the exploited.



Just over a year ago, the <a href="https://blockworks.co/news/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether">Wormhole bridge was attacked</a> in one of the largest crypto loss events of 2022. Altogether, around 120,000 ETH was stolen — $325 million at the time.



Those <a href="https://blockworks.co/news/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses">funds were replaced by Jump Crypto</a>, the Chicago-based crypto arm of Jump Trading, which was involved in the development of the Wormhole protocol. Jump’s motive was “to make community members whole and support Wormhole now as it continues to develop” according to a <a href="https://twitter.com/jump_/status/1489301013408497666?s=20">tweet</a> issued by the company at the time.



Wormhole offered a $10 million bug bounty and white hat agreement to the hackers in exchange for returning the funds. It appears that never happened.



Dave Olsen, Jump Trading Group’s president and CIO, told Bloomberg a month later that “We’re working in very close consultation with government resources, with private resources. There is a lot of firepower that is expert at tracking down criminals like this. And we are in this fight permanently. So this is not something that we will become distracted by next month or next year — this is a permanent condition.”



According to a blockchain-based analysis by Blockworks Research, Jump finally won that fight. And it appears that as of three days ago, those funds have now been recovered.



Jump Crypto declined to comment on the findings, and Oasis did not reply to a request for comment.



However, Oasis released a <a href="https://blog.oasis.app/statement-regarding-the-transactions-from-the-oasis-multisig-on-21st-feb-2023/">statement</a> following publication of this article, noting that:



&#8220;On 21st February 2023, we received an order from the High Court of England and Wales to take all necessary steps that would result in the retrieval of certain assets involved with the wallet address associated with the Wormhole Exploit on the 2nd February 2022. This was carried out in accordance with the requirements of the court order, as required by law, using the Oasis Multisig and a court authorised third party.



We can also confirm the assets were immediately passed onto a wallet controlled by the authorised third party, as required by the court order. We retain no control or access to these assets.&#8221;



Blockworks Research analyst <a href="https://twitter.com/smyyguy">Dan Smith</a> <a href="https://www.blockworksresearch.com/research/we-do-a-little-counter-exploit" target="_blank" rel="noreferrer noopener">detailed the process</a>:



<hr class="wp-block-separator has-alpha-channel-opacity"/>



&#8220;The transaction history suggests that Jump Crypto and Oasis worked together to counter exploit an upgradable Oasis contract, securing the stolen funds from the original Wormhole Exploiter’s vaults.&nbsp;



The Exploiter has continuously moved the stolen funds through various Ethereum applications. They recently opened two Oasis vaults, creating a levered long position on two ETH staking derivatives. Importantly, both vaults used the automation services offered by Oasis.&nbsp;



Several wallets were involved in the counter exploit. Each address is defined and given an alias that is used throughout the analysis.&nbsp;



<ul class="wp-block-list">
<li>Oasis Multisig: A 4 of 12 multisig that owns the Oasis proxy contracts.&nbsp;</li>



<li>Holder: Currently holds the recovered funds and appears to be owned by Jump.&nbsp;</li>



<li>Sender: Responsible for executing the counter exploit and appears to be owned by Jump.</li>
</ul>



The process began on February 21 when the Sender was added as a signer to the Oasis Multisig. The Sender executed five transactions to facilitate the counter exploit and was subsequently removed as a signer from the Oasis Multisig.&nbsp;



The bulk of the recovery process was executed in the Sender’s third transaction to the Oasis Multisig. To quickly summarize this transaction, the Sender tricked the Oasis contracts into allowing it to move the collateral and debt from the Exploiter’s vaults into the Sender’s own vaults.



After taking control of the Exploiter’s vaults, a wallet tagged Jump Crypto by several analytics firms sent 80M DAI to the Sender. This DAI was used to repay the open loans on the vault and withdraw the $218M of collateral. The recovered collateral was then sent to the Holder, where the funds currently reside.



It is currently unknown if the Sender and Holder are owned by Oasis or Jump. However, the base case hypothesis is that Jump has control of these addresses, given Jump paid down the debt to withdraw the collateral. Neither Jump nor Oasis have confirmed this.&nbsp;



Thus, it appears Jump successfully counter-attacked the Wormhole Exploiter and retrieved the ETH that was stolen from it one year ago. After considering the DAI repayment to retrieve the collateral, the net return from the counter exploit was around $140M.&#8221;



<a href="https://www.blockworksresearch.com/research/we-do-a-little-counter-exploit" target="_blank" rel="noreferrer noopener">See the full analysis at Blockworks Research</a>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Cross-chain bridge hacks have accounted for many of the largest thefts in the crypto industry, and include the Ronin hack that resulted in the loss of $540 million, later <a href="https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge">attributed</a> to the North Korean Lazarus state hacking group.



But permissionless blockchains, being transparent and open to the public, are proving to be exceptional tools for those fighting financial crime.



The ethics, and perhaps even the legality, of exploiting the exploiter may be debated in the coming days. But for now, it seems Jump Crypto is about $140 million better off than it was last week.



And one hacker may be ruing the missed opportunity to secure $10 million and a Get Out of Jail Free card.



Updated on Feb 24 2023 at 5:04pm ET: Added statement from Oasis.

Jump Crypto Just Counter-Exploited the Wormhole Hacker for $140 Million

Jacquelyn Melinek

<div id="highlights-block_61dd97b079aa2" class="highlights">
 <ul>
 <li>The fund is now up 25% from $160 million in November</li>
 <li>“Since we launched in mid-November we have received tons of applications from the community entrepreneurs and founders who want to build projects on the network,” Lu said</li>
 </ul>
 
</div>



An extra $40 million was added to the Oasis Ecosystem Fund, just two months after it was launched, to help build decentralized applications for DeFi, NFTs, the metaverse and more on the Oasis network, according to an announcement Tuesday.&nbsp;



The fund is now $200 million, up 25% from <a href="https://cms.blockworks.co/oasis-foundation-launches-160m-fund-for-defi-nfts-metaverse-and-more/" target="_blank" rel="noreferrer noopener">$160 million</a> in November, after Binance Labs announced its participation in the fund, Linda Lu, head of ecosystem at Oasis said in an interview with Blockworks. 



The capital will be used to invest in the next wave of applications on the network and support ecosystem growth, Lu said. 



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="768" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png" alt="The Oasis ecosystem" class="wp-image-13775" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=343 343w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=348 348w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=292 292w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/2022-01-11-oasis-ecosystem-1024x768.png?w=1600 1600w" sizes="(max-width: 1024px) 100vw, 1024px" /><figcaption>The Oasis Ecosystem Source; Oasis</figcaption></figure>



<a href="https://cms.blockworks.co/binance-labs-led-12m-investment-round-for-woo-network/" target="_blank" rel="noreferrer noopener">Binance Labs</a> is the venture capital and innovation incubation subsidiary of cryptocurrency exchange company Binance. It has invested in over <a href="https://labs.binance.com/" target="_blank" rel="noreferrer noopener">100 projects</a> across the blockchain ecosystem, according to its website. 



<div class="wp-block-image"><figure class="alignright size-medium"><img loading="lazy" decoding="async" width="300" height="300" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg" alt="" class="wp-image-13777" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=150 150w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=257 257w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=261 261w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=219 219w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/01/Linda-Lu-300x300.jpeg?w=320 320w" sizes="(max-width: 300px) 100vw, 300px" /><figcaption>Linda Lu</figcaption></figure></div>



Oasis Network is a layer-1, proof-of-stake, decentralized network designed to enable data privacy within DeFi, dApps, NFTs, DAOs and other Web3 applications. 



Other participants who previously invested in the fund include AME Cloud Ventures, Dragonfly Capital Partners, Draper Dragon, Electric Capital, FBG, Jump Capital, Hashed, Kenetic Capital, NGC Ventures, <a href="https://cms.blockworks.co/pantera-capital-ceo-terra-is-one-of-the-most-promising-coins-for-the-coming-year/" target="_blank" rel="noreferrer noopener">Pantera Capital</a> and Oasis Foundation.



“Since we launched in mid-November, we have received tons of applications from the community entrepreneurs and founders who want to build projects on the network,” Lu shared.&nbsp;



In recent weeks, Oasis partially funded YuzuSwap, the first decentralized exchange (DEX) built on its network, she said.&nbsp;



“From our perspective, we want to provide the best infrastructure for dApp developers and allow them to be successful,” Lu said. “We want to grow the ecosystem for the first half of the year and in the second half of [2022], build a community that will attract institutional investors to the DeFi space,” she added.



<hr class="wp-block-separator"/>
Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
<hr class="wp-block-separator"/>