The hacker behind the $321 million Wormhole bridge attack has shifted a large chunk of stolen funds, with transaction data showing that $155 million worth of Ether (ETH<\/a>) was transferred to a decentralized exchange (DEX) on Jan 23. <\/p>\n The Wormhole hack was the third largest crypto hack in 2022<\/a>, after the protocol\u2019s token bridge suffered an exploit<\/a> on Feb. 2, 2022, that resulted in the loss of 120,000 Wrapped ETH (wETH) around worth $321 million.<\/p>\n According to the transaction history<\/a> of the hacker\u2019s alleged wallet address, the latest activity shows that 95,630 ETH was sent to the OpenOcean DEX and then subsequently converted into ETH-pegged assets such as Lido Finance\u2019s staked ETH<\/a> (stETH) and wrapped staked (wstETH). <\/p>\n #CertiKSkynetAlert<\/a> <\/p>\n We are seeing address \u200b\u200b0x629e\u2026 Wormhole Network Exploiter swap 95,630 Ether (~$155M) to stETH <\/p>\n Stay safe! pic.twitter.com\/ZR6zxlRuKX<\/a><\/p>\n \u2014 CertiK Alert (@CertiKAlert) January 23, 2023<\/a><\/p><\/blockquote>\n Digging into the transaction history further, crypto community members such as @spreekaway also highlighted that the hacker went on to conduct a slew of odd looking transactions. <\/p>\n For example, the hacker used their stETH holdings as collateral to borrow<\/a> 13 million worth of the DAI stablecoin, before swapping it out for more stETH, wrapping into stETH again and then borrowing some more DAI. <\/p>\n Wormhole exploiter has converted his ETH to wstETH and is going to borrow DAI against it it seems. pic.twitter.com\/9rhERSMG5u<\/a><\/p>\n \u2014 Spreek (@spreekaway) January 23, 2023<\/a><\/p><\/blockquote>\n Notably, the Wormhole team has taken the opportunity to once again offer the hacker a bounty of $10 million if they return all the funds, after it left an embedded message conveying such in a transaction via the Wormhole: Deployer. <\/p>\n The hacker\u2019s hefty ETH transaction appears to have had a direct impact on the price of stETH according to data<\/a> from Dune Analytics. The asset\u2019s price went from slightly under peg of 0.9962 ETH on Jan. 23, to as high as 1.0002 ETH the following day, before dropping back to 0.9981 at the time of writing.<\/p>\n Related: <\/em><\/strong>North Korea’s Lazarus Group masterminded $100M Harmony hack: FBI confirms<\/em><\/strong><\/a><\/p>\n With the Wormhole hack likely to catch more attention in light of the latest incident, blockchain security firms such as Ancilia, Inc. warned on Jan. 19 that searching the keywords \u201cWormhole Bridge\u201d in Google is currently showing promoted ad websites that are actually phishing operations. <\/p>\n The community has been warned to be diligent on what they are clicking on relating to this term. <\/p>\n #phishing<\/a> alert When you search “wormhole bridge” in Google, many of the “ad” entries are actually phishing site. E.g. \u2014 Ancilia, Inc. (@AnciliaInc) January 19, 2023<\/a><\/p><\/blockquote>\n<\/div>\n\n
\n
![](\"https:\/\/s3.cointelegraph.com\/uploads\/2023-01\/ccd48904-c438-4859-a814-349d8a3d0615.png\")
\n
hxxps:\/\/wormholebridge-multichain.com\/
hxxps:\/\/portaltoken-wormholebridge.com. Be careful about what you click and stay safe! pic.twitter.com\/C6JW2xeaUh<\/a><\/p>\n