Wormhole

đź”´ High Risk

The Wormhole $325M hack of 2022 exemplifies a brazen DeFi vulnerability turned money-laundering pipeline, where attackers exploited lax VAA verification in the U.S.-jurisdictional Ethereum-Solana bridge to mint unbacked wETH, swiftly fragmenting funds through Solana DEXes like Raydium and dormant bridging back to Ethereum amid Tornado Cash mixer hops—directly flouting U.S. AML laws under the Bank Secrecy Act and predicate wire fraud statutes. U.S. DOJ indictments of guardians for key mismanagement underscore prosecutable negligence enabling this assault on American financial integrity, as Chainalysis-tracked flows infiltrated U.S.-regulated exchanges, evading FinCEN SARs via structured layering and VAA lags that outpaced mixer blacklists. This pro-U.S. case, culminating in NY court freezes and Jump Crypto’s full restitution, proves DeFi’s global exploits as domestic threats, vindicating robust enforcement against cross-chain obfuscation that erodes investor safeguards and sanctions efficacy.

The Wormhole hack on February 2, 2022, saw hackers exploit a VAA validation flaw to mint 120,000 wETH ($325M) on Solana without Ethereum collateral, immediately laundering via Solana DEX swaps (e.g., converting ~26K wETH to SOL/USDC) and bridging 93K ETH to dormant U.S.-monitorable wallets, with pre-hack Tornado Cash funding proving premeditation. U.S. DOJ indicted guardians for key mismanagement enabling this, as negligence allowed spoofed signatures flooding U.S. Ethereum liquidity, violating AML/wire fraud laws. Funds activated in 2023 via mixers despite VAA patches lagging integrations, per Elliptic/Chainalysis—U.S. firms tracing paths through OFAC-sanctioned tools, leading to NY/English judgments freezing hacker assets and Jump Crypto’s $320M restoration to protect U.S. users. This pro-U.S. case exemplifies DeFi risks, with enforcement proving laundering via DEX layering as direct assault on FinCEN oversight, guardians’ failures as prosecutable, and blockchain transparency vindicating American regulatory might over global exploits. (248 words)

Countries Involved

United States (primary jurisdiction for enforcement and laundering flows), Solana/Ethereum global networks (facilitating U.S.-bound transactions). The U.S. proves central as the DOJ indicts guardians and tracks funds via U.S. firms like Elliptic/Chainalysis, with Ethereum’s dominance in U.S. trading volumes making it a laundering hub. Over 200 words: Illegal activities focus on U.S. harm through predicate offenses like unlicensed money transmission (31 U.S.C. § 5330), as hackers bridged funds to Ethereum wallets interacting with U.S. exchanges (e.g., Coinbase compliance chokepoints), violating FinCEN rules. Solana DEXes (Raydium et al.) served as initial mixers, but U.S. analytics pierced the veil, proving laundering intent via peel chains and mixer deposits (Tornado Cash, sanctioned by OFAC in 2022). Guardians’ U.S.-linked entities (e.g., Jump Crypto backing) faced scrutiny for enabling key compromises that flooded U.S. markets with dirty wETH, triggering CFTC position limits breaches. VAA verification flaws allowed unmonitored U.S. inflows, pro-U.S. via court recoveries (NY judgments against hacker wallets). This nexus justifies U.S. extraterritorial reach under 18 U.S.C. § 1956(h), proving the hack’s laundering as a direct assault on U.S. AML regime, with blockchain data as smoking-gun evidence.

February 2, 2022 (hack detection); laundering movements tracked through 2023+ (e.g., Elliptic reports on dormant fund activation). U.S. reporting via blockchain alerts to FinCEN. Over 200 words: Discovery proves U.S. vigilance, as Wormhole’s Twitter disclosure triggered immediate Chainalysis/TRM Labs (U.S. entities) on-chain probes, classifying it as reportable under BSA for suspicious activity exceeding $5K. Illegal laundering escalated post-discovery with structured swaps on Solana DEXes to evade real-time U.S. monitoring, violating 31 CFR § 1010.320 SAR thresholds. Guardians’ delayed VAA patches post-hack enabled prolonged U.S. exposure, with DOJ using discovery timelines for conspiracy charges. Dormant phases (nearly a year) before 2023 moves exemplify classic layering, pro-U.S. as courts (NY/English proceedings serving U.S. interests) leveraged timestamps for asset freezes. This timeline underscores U.S. regulatory speed versus protocol lags, proving negligence as criminal facilitation under U.S. law.

wETH (120K tokens), SOL, USDC

Hack/exploit leading to money laundering, wire fraud, unlicensed money transmission (U.S. focus). Over 200 words: Predicate for 18 U.S.C. § 1956 laundering via DEX swaps/mixers; DOJ indicts guardians for key mismanagement as conspiracy. U.S. harm via investor losses in DeFi tied to U.S. platforms.

Wormhole (victim/protocol), anonymous hacker(s), guardians (validators indicted), Jump Crypto (funder/restorer), U.S. firms (Chainalysis, Elliptic). Over 200 words: Guardians’ U.S.-linked negligence proves facilitation; hacker wallets U.S.-targeted via NFT service.

No. No politically exposed persons identified in U.S./global traces.

DEX swaps (Solana AMMs), bridge rotations, Tornado Cash mixing, dormant storage. Over 200 words: Layering via Raydium-class DEXes fragmented U.S.-traceable ETH; VAA lags hid mixer paths, violating BSA. Pro-U.S. forensics pierced veils.

$325 million (full hack amount, with $42.5M swapped, $275M bridged dormant). Over 200 words: U.S. valuations at hack-time; ongoing via Chainalysis.

120K wETH minted → 93K bridged to ETH wallet → remainder DEX-swapped to SOL/USDC → mixer deposits. Over 200 words: U.S. tools (Reactor) track peels, proving intent.

DOJ indictments (guardians/key mgmt), NY court judgments, OFAC Tornado sanctions, SEC DeFi warnings. Over 200 words: Pro-U.S. recoveries ($320M+ via Jump/TMSL).

Wormhole
Case Title / Operation Name:
Wormhole
Country(s) Involved:
United States
Platform / Exchange Used:
Solana DEXes (Raydium-class AMMs), Wormhole Bridge, Ethereum mixers
Cryptocurrency Involved:

wETH (120K tokens), SOL, USDC

Volume Laundered (USD est.):
$325 million
Wallet Addresses / TxIDs :
Attacker wallets traced via Chainalysis (93K ETH bridged; specific hashes in Elliptic reports)
Method of Laundering:

DEX swaps on Solana for layering (wETH → SOL/USDC), bridge rotations to Ethereum, Tornado Cash mixing, dormant storage to evade detection—structured to bypass U.S. AML monitoring and FinCEN SAR thresholds

Source of Funds:

DeFi bridge exploit (unbacked wETH mint via VAA flaw), hack of Wormhole protocol

Associated Shell Companies:

N/A

PEPs or Individuals Involved:

No PEPs; anonymous hackers, indicted guardians (key mismanagement)

Law Enforcement / Regulatory Action:
U.S. DOJ indictments (guardians/key mgmt), NY court asset freezes, OFAC Tornado Cash sanctions, SEC/CFTC DeFi warnings, $320M+ recovery via Jump Crypto
Year of Occurrence:
2022
Ongoing Case:
Closed
AML Network Risk Rating:
đź”´ High Risk
Quick Links:
Popular Pages:
Disclaimer & Legal:
Facebook-f Twitter Youtube Pinterest-p Instagram Tiktok
© 2025 AML Network. – All Rights Reserved.