Wormhole

Wormhole is a messaging layer between blockchains. A contract on one chain posts a message; a network of validators observes it and signs an attestation; a contract on another chain checks the signatures and acts. Token bridging is the best-known use, and Wormhole's docs are careful to say Wormhole itself is neither a blockchain nor just a token bridge. Portal Bridge, at portalbridge.com, is the main consumer app built on it.

The core code has been public on GitHub since July 2020. Its 2022 bug-bounty offer was signed with a Certus One contact address, the firm that first built it. Today the Wormhole Foundation describes itself as supporting development of Wormhole through grants, research and ecosystem programs, and runs wormhole.com and wormhole.foundation. The Foundation's terms of service, last revised in March 2024, are governed by Cayman Islands law; they do not give a registered address. Portal's site links to Wormhole Labs (wormholelabs.xyz), whose relationship to the Foundation neither site spells out.

The W token has a 10 billion maximum supply, with about 6.67 billion circulating according to CoinGecko. Wormhole's docs describe MultiGov, a cross-chain governance framework, but security-critical decisions still sit with the Guardians, not token holders.

Every Wormhole message becomes a Verified Action Approval (VAA) once enough Guardians sign it. The Guardian set has 19 members, which the security policy describes as some of the largest staking providers in crypto, and a VAA needs 13 signatures. Each Guardian runs full nodes of the connected chains, so a chain that forks or breaks consensus is disconnected rather than trusted. On some lower-activity chains a delegated subset of Guardians does the observing before the full set signs, which the docs say adds a per-chain trust assumption.

Two safety systems sit on top. The Governor caps how much value can leave each chain in a period and delays large transfers. The Global Accountant tracks the supply of every Wormhole-wrapped asset across chains and refuses transfers that would break it. Both are enforced by the Guardians, not by on-chain code alone.

Wrapped tokens matter for exit: a Wormhole-wrapped asset is only worth its underlying while the locked collateral on the source chain is intact. Issuers including Ripple, for its RLUSD stablecoin on layer-2 networks, use NTT instead so the token stays native. For how Wormhole's trust model compares with other bridges, see how Wormhole and Portal compare with other crypto bridges.

Wormhole does not publish a single fee schedule for Portal. What a user pays depends on the route. On a manual route the user signs two transactions, one on each chain, and pays only gas on both. On an automatic route a relayer submits the destination transaction for a fee quoted at the time of transfer. Wormhole's Connect FAQ lists automatic CCTP relay fees of about 4.2 USDC to Ethereum and 0.3 USDC to Base, Optimism, Arbitrum and Avalanche, charged at cost. The Guardians can set protocol fees by governance; the docs do not state that one is currently charged on token transfers.

Settlement routes price in a solver's spread instead of a relay fee. Wormhole Connect, the transfer widget that apps embed, can also offer gas drop-off, where the relayer swaps part of the transfer into the destination chain's gas token.

On 2 February 2022 an attacker exploited a signature-verification flaw in Wormhole's Solana contract and minted 120,000 wETH without depositing anything, worth about $326 million at the time. Wormhole offered a $10 million bounty for the funds' return, which went unanswered, according to rekt.news. Within 24 hours the missing ETH was replaced so that wrapped ETH stayed fully backed. Users did not bear the loss, but who supplied the ETH was not disclosed in the sources opened for this profile, and the stolen funds were not recovered.

Since then Wormhole says it has completed 29 third-party audits, publishes them in its GitHub repository, and runs a bug bounty on Immunefi paying up to $1 million. The Foundation's own website still cites $2.5 million; Immunefi's figure is the live one. An audit lowers the odds of a bug; it does not remove them.

The structural risks are plain. A coalition of 13 Guardians could approve a fraudulent transfer or upgrade the contracts, and 7 could freeze traffic by refusing to sign. Wrapped assets depend on the source-chain collateral and on the connected chain itself: in 2026 the Guardians fully deprecated Scroll in April, citing security considerations, then Berachain and Injective, and outbound transfers from a deprecated chain stop once Guardians disconnect their nodes. Wormhole does not offer insurance.

Using Portal needs a wallet on each chain involved, or a destination address typed in by hand. There is no account and no identity check in the transfer flow. A transfer is tracked on Wormholescan by its transaction hash or VAA, and Wormhole's toolkit docs cover manual VAA submission for a transfer that was started but never redeemed on the destination chain.

Moving funds back reverses the route: a wrapped token is burned on the destination chain and the original unlocked on the source chain, which again needs Guardian signatures and gas on both sides. The legacy Portal interface at legacy.portalbridge.com closed on 30 June 2026, and Wormhole told users to finish any transfers in flight before then.

The Foundation's website terms bar users in US-embargoed countries and people on US sanctions lists. When opened for this profile in October 2026, the W token portal at w.wormhole.com returned a "not available in your region" notice, so W-related services may be geo-restricted even where Portal is not.

Wormhole has no customer support desk. Its site links to a Discord server, a Telegram channel, the forum at forum.wormhole.com and the X account @wormhole, and the Foundation lists a general contact email. Developers use the docs and GitHub. Fake bridge sites and fake token-claim pages are common around large protocols with tokens, so reach Portal by typing portalbridge.com and check any claim site against links on wormhole.com before connecting a wallet.

Wormhole's 2025 and 2026 news has been mostly about token issuers adopting NTT and about trimming the list of connected chains.

• July 2020: core repository published.
• February 2022: $326 million Solana contract exploit; backing restored within a day.
• March 2024: current Wormhole Foundation website terms published.
• December 2025: Ripple's RLUSD begins expanding to layer-2 networks using Wormhole NTT.
• April 2026: Scroll fully deprecated by the Guardians.
• June 2026: Portal's legacy interface retired on 30 June.
• August and September 2026: Berachain and Injective deprecated.