Wintermute hack

Summary

Wintermute, a London-based algorithmic market maker, disclosed a roughly $160 million theft from its decentralized-finance operations on September 20, 2022. About $120 million of the loss was in stablecoins, with the rest in other tokens. ^[1][2]

Cause

Security analysts concluded the attacker exploited a known weakness in "Profanity," a tool used to generate vanity addresses (Wintermute's admin address began with a long string of zeros to save gas). Days earlier, 1inch had warned that Profanity-generated keys could be brute-forced. Wintermute had removed funds from the address but reportedly left it as an admin on its vault, allowing the attacker — once they recovered the key — to call privileged functions and drain it. The firm said it remained solvent. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.