Wintermute Whacked by $160M Hack Exploiting Known Vulnerability

The market making firm remains “solvent” with about $320 million in equity remaining, CEO Evgeny Gaevoy said

article-image

Blockworks exclusive art by axel Rangel

share

key takeaways

  • A bug in vanity address generator Profanity suspected as attack vector, security experts say
  • Stablecoins, the vast majority of the funds, have been deposited to Curve Finance, likely to evade blacklisting

Liquidity provider Wintermute, which provides liquidity across most CeFi and DeFi exchanges, has suffered a major setback in a second security-based incident this year.  

CEO Evgeny Gaevoy disclosed in a Twitter thread on Tuesday that the platform encountered a $160 million breach in its decentralized finance (DeFi) operations. The firm’s CeFi operations and over-the-counter services weren’t affected, he said.

Gaevoy indicated Wintermute remains solvent, with $320 million in equity left after the hack. Users can expect the platform to face disruptions over the next few days until operations return to normal. 

The CEO said the firm is “open to” treating the situation as a white hat, referring to hackers that just test vulnerabilities in a system, as compared to malicious hackers. It’s not known whether that is the hacker’s intent.

Loading Tweet..

Wintermute is among the largest crypto liquidity providers dedicated to crypto market making for exchanges including Binance and Coinbase.

The hack is already having knock-on effects, such as the pausing of trading on Bebob, an upstart DeFi dex using Wintermute’s market making services.

Tuesday’s incident marks the second time the firm was involved with a hack this year. In June, a hacker stole 20 million Optimism tokens by exploiting a failed transaction with Wintermute.

Security experts point to a known bug as Wintermute hack vector

Mudit Gupta, chief security officer at Polygon, guessed in a tweet that the hack was a result of a hot wallet compromise due to the Profanity bug uncovered by 1inch contributors last week. 1inch had warned that wallet addresses generated using the Profanity tool were at risk of compromise.

“If you used Profanity to get a vanity smart contract address, make sure to change the owners of that smart contract,” 1inch staff wrote in a Sept. 15 blog post.

The contributors noted that Profanity’s popularity didn’t mean it wasn’t without defect, and that its vulnerability enabled hackers to “secretly” steal tens of millions of dollars from users’ wallets.

“It’s not a simple task, but at this point it looks like tens of millions of dollars in cryptocurrency could be stolen, if not hundreds of millions,” they said in the post.

The Ethereum address associated with the Wintermute hack held nearly $13 million in wrapped bitcoin (WBTC) and $9.3 million in ETH, among other tokens including matic, DYDX and FTX tokens as of 6:15 am ET on Tuesday.

Most of the stolen funds — $114 million in USDC and USDT stablecoins — have been moved to Curve Finance flagship “3Crv” liquidity pool. That may make it harder for centralized stablecoin issuers Circle and Tether to freeze the tokens, as they are commingled within the $869 million pool.

A Tether spokesperson told Blockworks that the firm is ready to collaborate in any investigation that law enforcement will initiate to help in the recovery of such funds.

Gaevoy didn’t specify when the hack took place or how it happened. In a later tweet, he offered the hacker a 10% bounty on the funds if returned. Wintermute and Circle didn’t return Blockworks’ request for comment by press time.

This story was updated on Sept. 20 at 11:42 pm ET.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

kamino cover.jpg

Research

Kamino has solidified its position as the leading money market on Solana and is emerging as a DeFi bluechip. Although DeFi competition is fierce, Kamino has kept iterating on its product to provide the best-in-class UX, paired with a robust risk management framework and battle-tested infrastructure. Given the rollout of Kamino Lend V2, the protocol may scale aggressively over the coming months, penetrating previously untapped markets in Solana DeFi.

article-image

Also in the tokenized fund space, Franklin Templeton launches on Base and Securitize hits $1 billion in tokenized RWA onchain

article-image

It turns out that bitcoin never actually hit an all-time high in March. Thanks a lot, inflation.

article-image

Spire, Citrea and Nillion also announced raises this week

article-image

The latest recipient of an SEC Wells notice is a Web3 gaming company

article-image

Thursday’s selloff was led by tech stocks, triggered by disappointing outlooks from giants Meta and Microsoft

article-image

Historically, positive returns have been a bit more of a toss-up during the year’s 11th month