Everyone wants a piece of the staked ETH game…including the Wormhole hackers.

What Happened: Blockchain security firm Certik issued an alert on Monday that the wallet address associated with the Wormhole hack had moved $155 million of Ethereum – the largest movement of stolen funds over the last few months.

The wallet address in question now holds 8 ETH worth $13,000 and 69,000 wrapped staked ETH worth $124 million.

The wormhole hackers stole $321 million last February in the third-largest exploit in DeFi history.

Where the Funds Went: Data from blockchain explorer Etherscan shows that the hacker(s) moved the funds to the OpenOcean decentralized exchange before converting them into Lido Finance’s staked ETH (stETH) and wrapped staked ETH.

They also used stETH as collateral to borrow 13 million worth of the stablecoin DAI, which they then proceeded to swap for more stETH. He repeated this type of transaction a few more times, all while time-weighted average price (TWAP) trading out of SOL trades – something that was spotted by a member of the crypto community, who goes by the Twitter handle “spreekaway.”

 Why Staked ETH? The amount of ETH staked in the deposit contract has surged over 16 million, according to data from Glassnode. The rise in staked ETH over the last few weeks presumably comes down to one factor – Ethereum’s Shanghai upgrade.

 A shadow fork of the Shanghai upgrade was deployed at around 5:40 pm ET, signaling that the much awaited upgrade is moving closer to reality. This upgrade is particularly significant for those staking ETH on the deposit contract because Shanghai will bring the much awaited functionality of being able to withdraw deposits.

 Are the Hackers Degens? Amid one of the worst bear market’s in the industry’s history, the crypto community – and apparently, the hackers – have become especially interested in liquid staking derivatives (LSD) such as stETH.

With Ethereum now being a full-fledged Proof-of-Stake blockchain, users can stake their ETH and earn rewards. However, the problem is that staking requires you to lock up your tokens. 

Liquid staking is a solution offered by staking pools like Lido Finance that allows you to retain liquidity so your money isn’t locked up. Staking with a liquid staking derivatives provider allows you to receive a token in exchange for your ETH to retain liquidity. All you have to pay is a 5-10% commission fee. 

Because of the Shanghai upgrade, users are now seeing an end date in sight to withdraw their staked ETH – this could explain why the hackers were eager to put their money into stETH.

The upcoming liquidity event has potentially helped Lido Finance overtake DeFi giant MakerDAO in terms of Total Value Locked over the last few weeks. Lido has seen a 39% surge in TVL over the last month with $8.2 billion currently locked on the platform.

LSDs will be an interesting area of crypto to watch over the coming weeks, with everyone from retail investors to DeFi hackers piling in to the action.