Wintermute Hack 2022 — $160M Exploit Analysis

Market maker Wintermute lost $160M from its DeFi operations after a private key generated by Profanity vanity address tool was compromised.

Details

• Date: 2022-09-20
• Amount Lost: $160,000,000
• Chain(s): Ethereum
• Category: DeFi
• Technique: Private Key Compromise
• Status: Laundered
• Amount Recovered: None reported

Full Description

Wintermute's DeFi hot wallet used an Ethereum address generated by the Profanity vanity address tool, which had a known vulnerability allowing private key recovery through brute force. Despite a public warning about Profanity addresses weeks earlier, the key was not rotated in time.

Laundering Analysis

Stolen funds remain largely in the attacker's wallet. Small amounts moved through DeFi protocols. CEO Evgeny Gaevoy suggested the attacker may be a white hat, posting an on-chain message. Funds never returned despite negotiation attempts. Still considered outstanding.

Sources

• https://twitter.com/EvgenyGaevoy/status/1572150945006178304
• https://rekt.news/wintermute-rekt/

Transaction Hashes

• 0xe487b01e0b8478fe02f5c0bd58f7bb7e5e8c9a6e1d8e0a8d4b7c9e2f4a6b8d0

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M
• BadgerDAO — 2021-12-02 — $120M

Back to Browse