Cork Protocol Exploited for $12M in wstETH Drain - DeFi Hack News 2026

Cork Protocol, an Ethereum-based platform focused on tokenizing depeg risk, was drained for roughly $12 million in wrapped staked ETH (wstETH). The attacker used a malicious contract to withdraw 3,761.87 wstETH from the protocol's vaults, then consolidated the proceeds into raw ETH without immediately laundering them. Contracts were paused within hours. The exploit is the latest in a string of DeFi security failures that have characterized 2026.

What happened

Cork Protocol disclosed that an attacker drained 3,761.87 wstETH, worth roughly $12 million at prevailing prices, from the protocol via a malicious contract interaction. The exploit was contained within hours, with Cork pausing the relevant smart contracts to prevent additional loss. The stolen wstETH was unwrapped and converted to native ETH, then consolidated into a single attacker-controlled address.

As of the most recent on-chain checks, the funds had not been moved through Tornado Cash, Railgun, or any cross-chain bridge. That holding pattern is notable. In many DeFi exploits, attackers race to launder funds within hours. Cork's attacker has so far kept the proceeds parked in ETH, which leaves at least a theoretical recovery window open if Cork or law-enforcement counterparts can negotiate a return.

Cork has not disclosed the full technical post-mortem of the exploit. The protocol's public communications confirm the malicious contract pattern and the wstETH withdrawal, but the precise vulnerability has not been published. That gap is typical for the first 48 hours after a hack, while teams complete forensics and weigh disclosure trade-offs.

What Cork Protocol actually does

Cork is a relatively young DeFi primitive focused on a niche but interesting problem: tokenizing the risk of asset depegs. The protocol lets users buy and sell "depeg swaps," instruments that pay out if a target asset, for example stETH or USDC, deviates from its expected peg by more than a defined threshold. The structure is similar to credit default swaps in traditional finance.

To support those swaps, Cork holds the underlying asset, in this case wstETH, in collateral vaults. The depeg swap then pays out from those vaults if and when a depeg event triggers. The vaults are exactly the surface that the exploit targeted: by interacting through a malicious contract, the attacker was able to extract collateral without the corresponding depeg trigger.

The product itself is conceptually sound. The exploit is a smart-contract failure in the implementation, not a failure of the depeg-swap economic model. That distinction matters for any rebuild: the underlying product can survive a security incident if the team can articulate the vulnerability, patch it, audit the fix, and communicate transparently with depositors.

Where this sits in the 2026 hack landscape

2026 has been a brutal year for DeFi security. Total stolen from DeFi protocols this year already exceeds $2 billion. The largest single incident remains the $292 million KelpDAO bridge exploit attributed to North Korea's Lazarus Group, which drained 116,500 rsETH via poisoned RPC manipulation. Drift Protocol lost $280 million in a separate Lazarus-linked attack on Solana. Cetus Protocol on Sui lost $223 million through an AMM overflow flaw. Verus's Ethereum bridge was exploited for over $5,400 ETH-equivalent in May.

Cork's $12 million is small by that comparison, but it fits a pattern. Most 2026 exploits have come from one of three vectors: bridge verification flaws, oracle manipulation, or smart-contract logic bugs in newer protocols that scaled before completing thorough audits. Cork falls in the third category. The protocol is young, the product is novel, and the attack surface is intricate enough that even well-intentioned reviewers can miss critical paths.

Market impact

The direct impact on wstETH and the broader Ethereum staking ecosystem is minimal. Lido's stETH float is over $30 billion, and the wrapped variant wstETH circulates in similar size. A $12 million extraction is well within the noise band of normal liquidity flows. Lido itself is unaffected: the wstETH was held in Cork's vaults, not in Lido's contracts.

The broader market response was muted. ETH price did not react meaningfully to the disclosure, and stETH continued to trade tightly to its peg. The contained nature of the exploit, combined with Cork's small size relative to the major DeFi protocols, kept contagion limited.

For Cork's depositors, the impact is more direct. The protocol's TVL is now lower by the stolen amount, and any recovery depends on negotiation with the attacker or eventual law enforcement action. The team has not yet published a remediation plan, including whether affected users will be compensated from the treasury or whether the protocol will resume operations after a patch and audit.

Context: the recovery question

One distinctive feature of the Cork exploit is the attacker's behavior post-theft. Funds remain in ETH, in a single address, unmixed. This pattern is sometimes consistent with white-hat or grey-hat activity, where an exploiter intends to return funds in exchange for a bounty. It is also consistent with attackers waiting out the initial scrutiny period before laundering, hoping that compliance attention will fade.

Cork has not disclosed whether on-chain communication with the attacker has begun. In several prior incidents, protocols have successfully negotiated returns by offering 10% to 20% of stolen funds as a bug bounty and a no-prosecution agreement. The Cetus Protocol case earlier in 2026 is a relevant precedent: Cetus offered the hacker a $6 million bounty against the $223 million theft, and partial recovery negotiations played out publicly on-chain.

If the Cork attacker accepts a similar bounty arrangement, the protocol could recover meaningful capital and resume operations. If not, the funds will likely remain in ETH for an extended period before any movement, since increased law-enforcement attention on crypto laundering routes has made discreet exits substantially harder than they were two years ago.

How to track

The stolen wstETH and its ETH derivative can be tracked on Etherscan via the attacker's consolidated address, which has been published by several on-chain forensics accounts. Movement of those funds, especially into a mixer or bridge, would be the first signal that recovery is unlikely.

For Cork users, the official protocol channels are the only source for compensation or restart timelines. Generic DeFi monitoring services, including DeFiLlama and DexTools, will reflect any TVL or trading recovery as it materializes.

FAQ

Is Cork Protocol still operational?

Operations are paused as of the exploit. The team has not yet announced a restart timeline. Future operation depends on the vulnerability fix, audit completion, and any compensation plan for affected users.

Are Lido users affected?

No. The exploit drained wstETH that was held inside Cork's vaults, not inside Lido's contracts. stETH and wstETH continue to trade normally and Lido infrastructure is unaffected.

Can the funds be recovered?

Possibly. The stolen ETH remains in a single attacker-controlled address with no laundering activity yet. Recovery depends on negotiation, voluntary return, or eventual law-enforcement action.

Was the Cork exploit linked to North Korea?

No public attribution has been made. Several major 2026 DeFi exploits have been linked to the Lazarus Group, but Cork has not been associated with state-sponsored actors as of public reporting.

How does this compare to the bigger 2026 hacks?

The $12 million Cork loss is small compared to the KelpDAO $292M, Drift $280M, or Cetus $223M incidents. It fits a steady cadence of mid-sized DeFi exploits that, aggregated, account for the majority of 2026's $2B+ DeFi losses.

Related Guides

• Kelp DAO hit by $293M hack
• Polymarket UMA CTF Adapter Drained for $520K on Polygon
• Drift Protocol Drained of $270 Million Using Solana Durable