Who is holding the SOL from the created wETH by the hackers at the end?
The wETH pairs X amount of SOL with an ETH. When it's settled, it releases both the SOL and the ETH to the corresponding parties. When the wETH is falsely created, it creates the SOL it wraps.
In the case of the Wormhole bridge, there are transactions on both the Ethereum mainnet side (paid for in Ethereum gwei) and the Solana network side (paid for in Solana gwei). The only lossy factor is in the bridging fees themself which are typically a "flat" fee.