Cork Protocol Hacker Launders Loot Through Tornado Cash—Then Drops 10 ETH in Devs’ Legal Defense Fund

Crypto's latest heist takes a bizarre twist as the Cork Protocol exploiter plays Robin Hood—after robbing the vault.

Money Trail Gone Cold: The attacker funneled stolen funds through Tornado Cash, Ethereum's favorite privacy tool for criminals and privacy advocates (depending on who's asking).

Plot Twist: In a move that redefines 'mixed signals,' the exploiter donated 10 ETH to the very developers they screwed—earmarked for legal battles. Because nothing says 'sorry-not-sorry' like funding your victim's lawsuit budget.

Finance Jab: TradFi bankers watching this unfold probably needed a third martini—imagine explaining to regulators why your thief is crowdfunding your compliance team.

How the Cork Protocol hack happened

The attack on Cork Protocol took place on May 28 around 11:39 UTC and targeted the platform’s wstETH:weETH market, leading to a loss of approximately 3,761 wrapped staked ETH (wstETH).

According to the Cork team, the attacker exploited two advanced loopholes in the protocol’s code to pull off the hack, and deployed a malicious hook that bypassed usual validation checks.

Exploit overview:

At 11:39 UTC on May 28, Cork Protocol experienced an exploit resulting in the extraction of 3,761 WSTETH from the wstETH:weETH market.

Attacker targeted two sophisticated edge cases:

• Vector 1: Manipulated rollover pricing just before expiry, buying 3,761…

Upon draining the funds, decentralized exchange aggregator 1INCH was used to swap the assets, making them harder to trace or recover.

Cork Protocol says it continues to work closely with security partners to address the fallout and tighten security measures to guard against similar attacks in the future.