# Why Ketju rejected Portal Bridge (Wormhole)

- URL: https://riadefi.com/rejections/portal/
- Exposure: other
- Memo version: v1
- Reviewed: 2026-08-17
- Next review: 2026-11-17

## The memo

REJECTED. Portal is the token-bridging application built on Wormhole's messaging protocol, secured by a 19-node Guardian network requiring 13-of-19 signatures to attest a transfer. On 2022-02-02, a Solana program signature-verification flaw let an attacker forge a Guardian attestation and mint 120,000 wETH, about $325M, with no real backing — one of the largest bridge hacks on record. The loss was made whole only because Jump Crypto, a Wormhole backer, recapitalized the bridge within days and later clawed back further funds through an extraordinary counter-exploit; that is not a repeatable institutional guarantee, and this registry does not treat an informal backer bailout as a substitute for the protocol's own controls being sufficient standalone. Post-incident additions — a Global Accountant that cross-checks minted supply against locked collateral, and a Governor that rate-limits and can hold large transfers for up to 24 hours — are real structural improvements and the incident-free record since 2022 is genuine, but they narrow the risk rather than eliminate the signature-forgery exposure class this bridge design remains inherently subject to.

## What would reopen the file

- Current Guardian-set composition and the specific authority controlling Guardian-set changes are independently confirmed
- Twelve consecutive months with no Guardian-quorum forgery or signature-verification incident, counted from this review's date
- The Global Accountant and Governor are confirmed live and correctly configured for the specific chain and asset pair a Ketju position would use
- A proposed-size redemption is demonstrated to clear within a documented maximum time, including the Governor's worst-case 24-hour hold

---

Published by Ketju Research (https://ketjuresearch.com). Educational analysis only; not legal, tax, compliance, or investment advice.
Machine-readable index: https://riadefi.com/llms.txt · Content API: https://riadefi.com/content.json