DeFi platform Cork loses $13.8M in wstETH; attacker uses malicious contract

Decentralised finance (DeFi) platform Cork Protocol has paused operations on one of its core trading markets after an apparent exploit drained thousands of wrapped staked Ethereum (wstETH) tokens.

Blockchain security firm SlowMist first flagged the incident on 28 May, citing a potential smart contract vulnerability that allowed an attacker to siphon 3,760 wstETH—valued at millions of dollars—from the protocol’s trading pools.

Cork Protocol later confirmed the breach, categorising it as a “security incident” that impacted the wstETH:weTH market.

While no other platform markets were reportedly affected, the protocol’s automated trading systems were paused as investigations began into the cause and scale of the exploit.

Malicious contract drained tokens in under 20 minutes

Preliminary analysis by Cyvers, a blockchain security firm, indicates the attacker used a malicious smart contract deployed via a wallet address funded by 0x4771…762B.

The origin of these funds is likely a service provider such as a decentralised exchange, DeFi bridge, or liquidity aggregator integrated with Cork Protocol.

The contract was executed just 16 minutes after funding. It successfully converted stolen wstETH into Ethereum, although the resulting ETH has not yet been moved to other wallets or exchanged for stablecoins.

The speed of the exploit suggests automated contract vulnerabilities rather than human operational error, and the attacker may have relied on known code libraries or proxy upgrade mechanisms to launch the attack.

Investigations ongoing, but broader implications loom

At the time of writing, Cork Protocol has not issued a timeline for reopening its paused contracts or restoring affected user balances.

Investigators are working to determine whether the flaw originated in Cork’s own codebase or through an integrated third-party application.

So far, no white-hat recovery attempts or on-chain communications from the attacker have been reported.

While no user funds in other markets have been reported lost, the incident puts pressure on DeFi protocols relying on wrapped token mechanisms.

The exploit also raises questions about the due diligence performed on smart contracts, especially those interacting with restaking tokens and derivatives in a high-risk environment.

The exploit is part of a broader trend in 2025 where attackers are targeting complex token infrastructures, particularly those tied to liquid staking.

These wrapped ecosystems, though essential to advanced DeFi activity, are increasingly becoming honeypots for vulnerabilities due to their reliance on multiple layers of smart contract infrastructure.

If future audits do not reveal and address the underlying vulnerability, similar incidents may continue across protocols offering depeg hedging products or other forms of token insurance.