Jump Crypto has seemingly recovered 120.69k wstETH and 3.21k rETH ($225M of assets) from the infamous Wormhole Exploit that occurred one year ago. A recovery group, what appears to be Jump Crypto and Oasis, “counter exploited” an upgradable proxy contract on the Oasis protocol, securing the stolen funds and transferring them to a fresh wallet.

Jump nor Oasis have publicly confirmed this.

The Wormhole Exploiter (the Exploiter) has continuously shuffled the stolen funds through various dapps on Ethereum. Most recently, they held two Oasis vaults: a wstETH vault opened on January 23, and a rETH vault opened on February 11. Between January 23 and February 16, the Exploiter used these vaults to borrow DAI and lever long ETH staking derivatives. By February 16, the two vaults drew a total of $78M of DAI debt against $220M of collateral. Importantly, both vaults used the automation services offered by Oasis.

For simplicity, only the recovery of the wstETH vault (vault ID 30100) is analyzed because it held $219M wstETH compared to the $6M rETH in the rETH vault (vault ID 30179). Note that the counter exploit simultaneously recovered the funds in both vaults.