Was the $160M Wintermute Hack an Inside Job?

The $160 million hack of market maker Wintermute might have been an inside job, according to one blockchain analyst.

The liquidity provider, among the largest dedicated to crypto market making, was allegedly hacked due to a recently discovered “vanity address” vulnerability in its DeFi (decentralized finance) operations. CEO Evgeny Gaevoy, who said the firm remained solvent, asked the hacker to get in touch and offered a 10% bounty if the funds were returned.

But a new theory by James Edwards, who goes by the name Librehash on Medium, claims the hack could be pinned down to Wintermute’s own team.

In a blog posted on Monday, Edwards said the prevailing theory maintains that an externally owned address (EOA) behind the “compromised” Wintermute wallet was itself compromised because of a vulnerability in a vanity address generator tool. 

But he disputed that theory after analyzing the smart contract and its interactions, concluding that the knowledge required to go through with the hack rules out the possibility that the hacker was random or external. 

Edwards noted that the smart contract at issue has “no uploaded, verified code,” which makes it difficult for external parties to confirm the external hacker theory and raises the issue of transparency. 

“The relevant transactions initiated by the EOA make it clear that the hacker was likely an internal member of the Wintermute team,” he wrote.

Further, on conducting an Etherscan analysis, he said the compromised smart contract received two deposits from Kraken and Binance’s hot wallets. “It’s safe to assume that such a transfer must have been initiated from team-controlled exchange accounts,” he said.

Less than a minute after the compromised Wintermute smart contract received over 13 million in Tether (the total amount of that token), the funds were sent from the wallet manually to a contract supposedly controlled by the hacker.

“We know the team was aware the smart contract had been compromised at this point. So why initiate these two withdrawals directly to the compromised smart contract smack in the middle of the hack?” he said on Twitter.

Edwards believes the Wintermute team should provide an explanation of how the attacker would have the necessary signature for contract execution and know which functions to call, since there’s no contract source code published. He suggested only someone with intimate knowledge would have the capacity to do so. 

Edwards is not a professional cybersecurity analyst and his blog on the Wintermute hack appears to be his debut Medium post. But he’s previously put out Twitter threads analyzing possible money laundering on various crypto projects.  

The large scale theft was another blemish on the record of the industry as it would hurt the confidence of TradFi (traditional finance) institutions looking to enter the space, according to Marcus Sotiriou, analyst at GlobalBlock. “As Wintermute was one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss,” he said.

Wintermute didn’t return Blockworks’ request for comment by press time.

---

Get the news in your inbox. Explore Blockworks newsletters:

• The Breakdown: Decoding crypto and the markets. Daily.
• 0xResearch: Alpha in your inbox. Think like an analyst.