Wormhole Counter-exploit Forces Scrutiny of Multisigs in DeFi

A set of criteria had to be met before the counter-exploit could happen. Does that make it centralized?

article-image

maximlacrimart/Shutterstock.com modified by Blockworks

share

The spectrum of decentralization has been a hot topic following a counter-exploit recently executed by Jump Crypto on the Wormhole hacker who stole 120,000 ETH — around $325 million — in February last year.

After receiving an order from the High Court of England, Oasis — a privately owned app deployed on top of decentralized finance (DeFi) protocol MakerDAO — carried out a counterattack by adding an “authorized third party” to its multisig. The third party — believed to be Jump — then used it to upgrade Oasis’ proxy contract, ultimately seizing the funds.

Many industry participants raised concerns about this move as an indication of the centralization of DeFi, and whether these upgradable contracts should be used at all.

Wait, what’s a proxy contract?

In an interview with Blockworks, Joe Coll, a venture investor at Framework Ventures, said that proxy contracts provide upgradability to a protocol’s set of smart contracts.

“When contracts are immutable — when they’re non-upgradable, it requires the entirety of the network to fork out the code,” Coll said.

Uniswap is one example of this type of protocol. That’s why Uniswap, over several years, deployed discrete versions of its market-leading decentralized exchange, the most recent being “Uniswap V3.” Previous versions are still operating — just as they always have been since their original deployment — and will continue to do so as long as the Ethereum network is producing blocks.

Had Uniswap instead used proxy contracts, it could instead have retired the older versions.

“When a user sends a transaction through a proxy contract, it will point it to another contract that contains the core logic, almost like a router,” Coll said.

Proxy contracts can be controlled in multiple different ways: It could be upgraded by a single private key, it could also be upgraded through on-chain votes where an entire community would have to use tokens to vote before any changes were made to the contract, or it could be controlled by a multisig, he said.

A multisig — short for multi-signature — is a cryptocurrency wallet with two or more key holders. 

In the case of the counter-exploit, the proxy contract was controlled by a 4 of 12 Oasis multisig — a known group of individuals who maintained multiple private keys that collectively enable transaction authorization.

“The nuance here is that a few days before all of this happened, what they described as a white hack group came to [Oasis] and identified a previously ‘vulnerability’ within this multisig proxy contract,” Coll said. “And once that was realized by them, and apparently realized by the court as well, the opportunity for unilateral action by this multisig was actually possible, and that’s what the court appears to have enforced.”

Does this mark the end of decentralization?

The short answer to this question is no, though lessons can be learned from this counter-exploit.

“Multisigs exist because [protocols] want to do something fast, and just because it has upgradability doesn’t mean they can do everything,” Coll said. 

In this particular situation, Coll notes that it was a “really nuanced combination with a vulnerability that was unknown in the middle of it.”

“Multisigs can be very legitimate and they can maintain decentralization if they’re implemented in the right way,” Coll said.

This sentiment is shared by Blockworks Research analyst Dan Smith, who noted that this particular exploit was a unique situation.   

“The real issue here is the use of proxies AND a centralized multisig. It’s the combination of both things. Proxies play an important role in DeFi and aren’t going anywhere anytime soon,” Smith said.

As proxy contracts are upgraded by their owners, a centralized multisig owner can remove this one aspect of decentralization.

“The UK gov forced Oasis — a private company [headquartered] in [the] UK — to let this counter-exploit happen,” Smith said. “People are not immune to regulation just because they build on blockchain rails.”

Code, on the other hand, when deployed in an immutable fashion, is much more resistant to interference, whether justified or not.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Featured.png

Research

Helium stands at a pivotal moment in its evolution as a decentralized wireless network, balancing rapid growth, economic restructuring, and global expansion. With accelerated growth in domestic DAUs and Hotspots supporting its network, Helium is leveraging strategic partnerships and innovative proposals to scale internationally. The recent implementation of HIP 138, “Return to HNT,” has unified its token economy under HNT, simplifying participation and strengthening liquidity, while HIP 139’s phase-out of CBRS refocuses efforts on scalable Wi-Fi offload. Meanwhile, governance shifts under HIP 141 raise questions about centralization as Nova Labs consolidates control over the roadmap.

article-image

“Be prepared to do more with less,” Framework Ventures’ Michael Anderson said

article-image

Q1 may have been “frustrating,” but things are looking brighter for Q2

article-image

Tokens worth 20% of the current supply of the TRUMP memecoin launched by the president are set to be unlocked tomorrow

article-image

A crypto-industry lawsuit is “moot” now that Joint Resolution 25 has been signed into law

article-image

Fed Chair Powell assured markets that the labor market is in “good place,” dependent on price stability

article-image

As uncertainty reigns, the Philly Fed manufacturing index fell to a multi-year low, but layoffs have slowed