Cork Protocol falls victim to $12m exploit, 3,760 wstETH stolen

May 28, 2025 at 2:18 PM UTC

Edited by Jayson Derrick

News

Cork Protocol falls victim to $12m exploit, 3,760 wstETH stolen

Hackers targeted a wrapped staked Ethereum contract, stealing tokens worth around $12 million.

Decentralized finance platform Cork Protocol reportedly suffered a major exploit. On Wednesday, May 28, security firm SlowMist highlighted a potential smart contract vulnerability involving 3,760 wrapped staked Ethereum (wstETH) tokens.

We are investigating a potential exploit and are pausing all contracts. We will report back with more information as soon as possible.
— Cork Protocol (@Corkprotocol) May 28, 2025

Following the report, Cork Protocol confirmed a “security incident,” affecting the wrapped staked Ethereum tokens and wrapped Ethereum tokens. As a result, the protocol paused its smart contract.

According to Cork Protocol, no other markets on the platform were affected. The team stated that they are actively investigating the situation and will provide updates.

What happened with the Cork Protocol?

According to the blockchain security firm Cyvers, the attacker deployed a malicious contract with an address funded by 0x4771…762B. Cyvers claims that this address likely belongs to a service provider, which means a DeFi protocol, exchange, or a bridge that Cork Protocol was using.

Just 16 minutes later, the malicious contract was executed, and the attacker quickly swapped the wstETH for Ethereum. The stolen ETH has not yet been moved to other wallets.

Cork Protocol allows users to hedge against the risk of token depegging, including wrapped stablecoins, liquid staking, and restaking tokens. The wstETH to weETH trading pair is one of the core markets the protocol securitizes.

All of these assets are forms of wrapped tokens, enabling users to perform DeFi operations not possible with the native assets. However, this also exposes users to added risks, including counterparty risk, smart contract vulnerabilities, and potential exploits. In the event of a hack or rug pull, the wrapped version of a token can become worth less than its unwrapped counterpart, leaving users with significant losses.

With Cork Protocol, users can buy depeg swaps to protect their assets if they fall below their peg. In addition to wstETH to weETH, the platform also offers securitization for wETH to wstETH, sUSDS to USDe, and sUSDe to USDT.