Etherscan records show that addresses related to the theft of $323 million worth of ETH in the cross-chain protocol Wormhole began transferring assets.
The attacker’s address integrated the stolen ETH, and converted 95,630 ETH (approximately US$157.2 million) into stETH through the DEX aggregator OpenOcean, and then stETH was converted into 86,473 wstETH.
The hacker also used wstETH as collateral to obtain a DAI loan of 13 million US dollars, which was used to purchase about 7989.5 ETH through KyberNetwork. The hacker repeated the process, continually increasing leverage.