Was the $160M Wintermute Hack an Inside Job?

Blockchain analyst alleges “the hacker was likely an internal member of the Wintermute team”

article-image

Blockworks Exclusive art by axel rangel

share

  • An external hacker wouldn’t have the knowledge required for contract execution, Edwards alleged
  • Wintermute must clarify how the attacker had the necessary signature required, he said

The $160 million hack of market maker Wintermute might have been an inside job, according to one blockchain analyst.

The liquidity provider, among the largest dedicated to crypto market making, was allegedly hacked due to a recently discovered “vanity address” vulnerability in its DeFi (decentralized finance) operations. CEO Evgeny Gaevoy, who said the firm remained solvent, asked the hacker to get in touch and offered a 10% bounty if the funds were returned.

But a new theory by James Edwards, who goes by the name Librehash on Medium, claims the hack could be pinned down to Wintermute’s own team.

In a blog posted on Monday, Edwards said the prevailing theory maintains that an externally owned address (EOA) behind the “compromised” Wintermute wallet was itself compromised because of a vulnerability in a vanity address generator tool. 

But he disputed that theory after analyzing the smart contract and its interactions, concluding that the knowledge required to go through with the hack rules out the possibility that the hacker was random or external. 

Edwards noted that the smart contract at issue has “no uploaded, verified code,” which makes it difficult for external parties to confirm the external hacker theory and raises the issue of transparency. 

“The relevant transactions initiated by the EOA make it clear that the hacker was likely an internal member of the Wintermute team,” he wrote.

Further, on conducting an Etherscan analysis, he said the compromised smart contract received two deposits from Kraken and Binance’s hot wallets. “It’s safe to assume that such a transfer must have been initiated from team-controlled exchange accounts,” he said.

Less than a minute after the compromised Wintermute smart contract received over 13 million in Tether (the total amount of that token), the funds were sent from the wallet manually to a contract supposedly controlled by the hacker.

“We know the team was aware the smart contract had been compromised at this point. So why initiate these two withdrawals directly to the compromised smart contract smack in the middle of the hack?” he said on Twitter.

Edwards believes the Wintermute team should provide an explanation of how the attacker would have the necessary signature for contract execution and know which functions to call, since there’s no contract source code published. He suggested only someone with intimate knowledge would have the capacity to do so. 

Edwards is not a professional cybersecurity analyst and his blog on the Wintermute hack appears to be his debut Medium post. But he’s previously put out Twitter threads analyzing possible money laundering on various crypto projects.  

The large scale theft was another blemish on the record of the industry as it would hurt the confidence of TradFi (traditional finance) institutions looking to enter the space, according to Marcus Sotiriou, analyst at GlobalBlock. “As Wintermute was one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss,” he said.

Wintermute didn’t return Blockworks’ request for comment by press time.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

The derivatives giant will extend futures and options access to round-the-clock trading in early 2026

by Blockworks /
article-image

Global fiber network goes live as SEC clears 2Z token for utility use

by Blockworks /
article-image

The SPAC transaction positions Avalanche Treasury Co. as a Nasdaq-listed vehicle for institutional AVAX exposure by 2026

by Blockworks /
article-image

The collaboration brings regulated money market fund exposure to Polygon, with custody provided by Standard Chartered

by Blockworks /
article-image

FG Nexus teams with Securitize to bring its Nasdaq-listed equity onchain, offering tokenized stock trading through Ethereum

by Blockworks /
article-image

Sponsored

Taiko launches binding onchain governance and appoints three directors with expertise in global regulation, business strategy and blockchain tech

by Sponsored /