Shalini Nagarajan

The California Department of Financial Protection and Innovation (DFPI) has issued fraud alerts about phony entities posing as decentralized exchange Uniswap and crypto market maker Wintermute.



The alerts came alongside posts for 14 other registered entities apparently peddling crypto-themed Advance Fee scams.



In one instance, the victim <a href="https://dfpi.ca.gov/2022/12/27/cryptocurrency-broker-uniswap-llc-appears-to-be-engaged-in-fraud-against-california-consumers/" target="_blank" rel="noreferrer noopener">claimed</a> a &#8220;UniSwap LLC&#8221; lured them into investing $14,000 in what was presented as a Uniswap liquidity mining venture.



Per DFPI: “The victim met a person calling themselves &#8216;Heitor Ryan&#8217; on the internet who claimed to work at a bank. They chatted as friends for several months, then Heitor lured the victim into investing on a crypto website that turned out to be a fraud.”



Another victim in a <a href="https://dfpi.ca.gov/2022/12/27/cryptocurrency-website-eth-wintermute-net-appears-to-be-engaged-in-fraud-against-california-consumers/" target="_blank" rel="noreferrer noopener">separate</a> scam was convinced to send more than $167,000 to who they believe was crypto trading outfit Wintermute.



“The victim met someone calling herself ‘Rosalie’ on WhatsApp, who introduced him to eth-Wintermute dot net, telling the victim this would generate dividends on liquidity pools every six hours based on the amount of money put into the MetaMask app wallet,” DFPI wrote (Blockworks advises caution when interacting with the quoted domain).



Phishers and other bad actors commonly spoof popular crypto platforms to <a href="https://blockworks.co/news/crypto-trading-bot-platform-3commas-rocked-by-critical-api-leak" target="_blank" rel="noreferrer noopener">target digital asset investors</a>. Users are advised to always triple check the domains they interact with. 



But 2022 will perhaps go down as the biggest year of crypto-related frauds in history so far, thanks in no small part to the Sam Bankman-Fried case.



Between January to November, investors lost more than $4 billion worth of crypto — a 37% jump from last year, according to a <a href="https://www.privacyaffairs.com/cryptocurrency-scams-2022/">study</a> by Privacy Affairs.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Fake Uniswap, Wintermute Reps Con Californian Crypto Curious

Casey Wagner

Topping off an already tumultuous year for cryptocurrency prices and company blowups, 2022 was a record year for crypto hacks.&nbsp;



From January 2022 to November 2022, hackers made off with $4.3 billion of cryptocurrency, up 37% from the same period in 2021, according to <a href="https://www.privacyaffairs.com/cryptocurrency-scams-2022/" target="_blank" rel="noreferrer noopener">data</a> from cybersecurity firm Privacy Affairs. Analysts at Solidus Labs estimate bad actors are launching up to 15 crypto-related scams per hour. 



We’ve rounded up the top hacks of the year — so far. 



<h3>Axie Infinity’s Ronin Network — $625 million </h3>



Coming in at the biggest breach of the year, hackers made off with more than $600 million from <a href="https://blockworks.co/tag/ronin" target="_blank" rel="noreferrer noopener">Ronin Network</a>, an Ethereum-linked sidechain used for blockchain game Axie Infinity in <a href="https://blockworks.co/news/sky-mavis-ronin-network-bridge-exploited-for-over-600m" target="_blank" rel="noreferrer noopener">March</a>. Exploiters, the network said, used hacked private keys to forge withdrawals on March 23. The breach wasn’t discovered until almost a week later, when a user was unable to withdraw 5,000 ETH.



Later, Sky Mavis, the company that built the bridge, <a href="https://twitter.com/trungfinity/status/1511416163313414147" target="_blank" rel="noreferrer noopener">acknowledged</a> that it may have sacrificed security for speed when developing the bridge. Sky Mavis then announced a $150 million raise, led by Binance, to reimburse affected users. Other contributors to the round included Paradigm, Animoca Brands, Dialectic, Accel and Andreesen Horowitz.



<h3>Wormhole Bridge — $320 million </h3>



In February, hackers targeted <a href="https://blockworks.co/tag/wormhole" target="_blank" rel="noreferrer noopener">Wormhole</a>, one of the largest cross-chain bridges between Solana and other blockchains. The bad actors exploited a vulnerability in Wormhole’s validation system, allowing them to make off with fraudulently generated wrapped ether. 



Hackers then used the chain to convert the wrapped ether into ether. Wormhole <a href="https://blockworks.co/news/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses" target="_blank" rel="noreferrer noopener">parent company</a> Jump Crypto later replaced all 120,000 ether the bridge lost. 



<h3>Nomad Bridge — $190 million </h3>



In August, DeFi bridge <a href="https://blockworks.co/tag/nomad" target="_blank" rel="noreferrer noopener">Nomad</a> lost $190 million in a hack that involved 960 transactions and 1,175 individual withdrawals. Users were able to exploit a bug in the protocol that allowed them to withdraw more than they had deposited. 



It is thought that once news of the bug spread, users rushed to exploit it themselves, resulting in a free-for-all involving onlookers rushing to submit illicit transactions, quickly draining the token bridge of all user funds kept inside its associated smart contract.



White hat hackers later returned at least $32 million to a recovery wallet address, <a href="https://blockworks.co/news/nomad-recovers-nearly-20m-of-stolen-190m" target="_blank" rel="noreferrer noopener">Nomad said</a>. The wallet was set up in association with custodian bank, Anchorage Digital. 



<h3>Beanstalk Farms — $182 million </h3>



Ethereum-based stablecoin protocol <a href="https://blockworks.co/tag/beanstalk" target="_blank" rel="noreferrer noopener">Beanstalk</a> lost $182 million in April when a hacker used a flash loan to buy a majority position in STALK, the protocol’s native governance token. The hacker then proposed a massive transfer of funds and approved it using their own majority vote. 



Nearly four months after the breach, the algorithmic stablecoin protocol relaunched. Beanstalk Farms <a href="https://blockworks.co/news/algo-stablecoin-protocol-beanstalk-relaunches-following-180m-hack" target="_blank" rel="noreferrer noopener">said it “unpaused” its services</a> on the one-year anniversary of its original August 2021 launch.



<h3>Wintermute — $160 million </h3>



In September, Liquidity provider <a href="https://blockworks.co/tag/wintermute" target="_blank" rel="noreferrer noopener">Wintermute</a>, which provides liquidity across most CeFi and DeFi exchanges, said it lost $160 million in a security breach. Wintermute is among the largest crypto liquidity providers, conducting market making services for exchanges including Binance and Coinbase.



There is <a href="https://blockworks.co/news/was-wintermute-160m-hack-an-inside-job" target="_blank" rel="noreferrer noopener">speculation that the hack was an inside job</a>, but no cause or perpetrator has been confirmed.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Crypto Thieves Made Off With $4.3B in 2022: Top Hacks of the Year

Ben Strack

With crypto exchange FTX <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">filing for bankruptcy</a> last week and other large industry players — such as <a href="https://blockworks.co/news/blockfi-eyes-bankruptcy-as-ftx-fallout-continues-report" target="_blank" rel="noreferrer noopener">BlockFi</a>, <a href="https://blockworks.co/news/genesis-halts-lending" target="_blank" rel="noreferrer noopener">Genesis</a> and <a href="https://blockworks.co/news/gemini-circle-genesis-exposure" target="_blank" rel="noreferrer noopener">Gemini</a> — enduring shockwaves of the collapse, talent is flooding the space but chasing a dwindling number of spots.



Crypto doesn’t have enough positions for all the people in the segment who have lost their jobs, <a href="https://workincrypto.global/" target="_blank" rel="noreferrer noopener">WorkInCrypto.Global</a> founder Sam Wellalage told Blockworks.&nbsp;



Despite that, Wellalage said based on meetings he had at the TOKEN2049 conference in London last week, plenty of companies are still hiring.&nbsp;



“All my 300 business cards were taken by companies and candidates,” he said. “It is wild. We expect to be very busy.”



Ex-FTX staff in the lurch



FTX employees have begun or are looking to scatter following the exchange <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">filing for bankruptcy</a> last week, and the Wall Street Journal Tuesday reported that BlockFi was planning staff cuts as it considers initiating Chapter 11 bankruptcy.&nbsp;



“A lot of the trust I have placed in society has vanished,” a recent employee of FTX told Blockworks in a message. “I still need time to process everything.”



Wellalage said Tuesday he had so far spoken to seven candidates that day from companies including FTX and BlockFi. He has mostly talked with marketing and business development employees, he said, as he seeks to help a Dubai-based crypto exchange fill open roles.&nbsp;



“They all want to stay in Web3, which is surprising,” Wellalage said of the crypto employees he has spoken to. “One of the key themes is that everyone thinks everything happening in the industry is [ultimately] for good.”



In addition to the collapse of FTX and others who are struggling as a result of exposure to the exchange, the broader crypto downturn in recent months has forced many crypto companies to cut headcount.&nbsp;



Valkyrie Investments <a href="https://blockworks.co/news/valkyrie-shrinks-staff-to-16-people-after-latest-cuts/" target="_blank" rel="noreferrer noopener">concluded a 30% cut</a> to its staff that started in June, shrinking the crypto ETF issuer’s headcount to 16 people, CEO Leah Wald told Blockworks Tuesday.&nbsp;



Competing issuers of ETPs, such as 21Shares and CoinShares, have not cut staff and don’t plan to, spokespeople for the firms said. CoinShares looks to maintain its staff levels despite the company’s <a href="https://blockworks.co/news/funds-with-ftx-exposure-have-7-to-12-of-aum-trapped-report" target="_blank" rel="noreferrer noopener">exposure to FTX</a> amounting to roughly $30 million.



Nearly 4,700 people have been laid off in the cryptocurrency sector between Jan. 1 and Nov. 13, according to <a href="https://www.coingecko.com/research/publications/tech-layoffs-by-sectors" target="_blank" rel="noreferrer noopener">a CoinGecko report</a> — representing about 4% of tech layoffs over that span.



Wintermute sends message to crypto talent



“Though layoffs are happening there are a ton of companies still growing right now,” Emily Landon, CEO of <a href="https://www.thecryptorecruiters.io/" target="_blank" rel="noreferrer noopener">The Crypto Recruiters</a> told Blockworks. “The bear market is for building! Companies may not be advertising their jobs, which is why networking is so important.”



Among those looking to boost headcount in the aftermath of FTX’s crash is crypto market maker Wintermute. The company said <a href="https://jobs.lever.co/wintermute-trading/cca667b7-41d2-400c-809c-20750120e5e2" target="_blank" rel="noreferrer noopener">in a blog post</a> this week that it was doubling down on its crypto conviction, in part by looking to hire. Open roles include positions in software development, algorithmic trading and business operations.&nbsp;



The company, which <a href="https://blockworks.co/news/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability" target="_blank" rel="noreferrer noopener">encountered a $160 million breach</a> in its DeFi operations in September, doesn’t have a set number of people it is looking to add, a spokesperson told Blockworks.&nbsp;



“It depends [on] the number of matches we find and we are open in some cases to create roles for exceptional people,” the representative said in an email. “We know many strong and determined people in the industry. Many of them lost their jobs because of insolvencies, layoffs and financial difficulties of former employers.”



Other firms onboarding amid crypto chaos



Georgetown University computer science professor <a href="https://people.cs.georgetown.edu/jthaler/" target="_blank" rel="noreferrer noopener">Justin Thaler</a> joined a16z’s crypto research team.&nbsp;



The venture capital firm <a href="https://blockworks.co/news/andreessen-horowitz-launches-largest-crypto-fund-ever" target="_blank" rel="noreferrer noopener">raised $4.5 billion</a> in May for its fourth crypto fund, bringing its total funds raised to more than $7.6 billion.



Thaler is set to be an in-house resource for portfolio companies and help the team advance the lab’s research and evaluation of zero-knowledge-based projects.



Tim Roughgarden, a research partner at a16z, said in a statement that it has been exciting to see Thaler in recent years move from the theoretical foundations of proof systems to their applications in blockchains and web3.&nbsp;&nbsp;



“This technology is rooted in some of the deepest mathematical results in all of computer science, and Justin’s understanding of it is second to none,” he added.&nbsp;



Crypto trading technology provider Talos added <a href="https://www.linkedin.com/in/joshpeschko/" target="_blank" rel="noreferrer noopener">Josh Peschko</a> as head of compliance and <a href="https://www.linkedin.com/in/alexander-abedine/" target="_blank" rel="noreferrer noopener">Alex Abedine</a> as vice president of regulatory.



The hires came at the same time the company said it was joining the Blockchain Association, a lobbying group focused on improving the public policy environment for crypto networks.&nbsp;



Prior to Talos, Peschko worked at AQR Capital Management, where he was most recently global head of trading and investment compliance. Before that, he was in a risk management monitoring position at JPMorgan.&nbsp;



Abedine was formerly senior product counsel at Coinbase, and was also previously a lead product counsel at Meta Platforms — advising on Instagram&#8217;s NFT marketplace, the expansion of Facebook Payments, and the launch of the Novi digital wallet and Diem digital currency.&nbsp;



Crypto exchange OKX named <a href="https://www.linkedin.com/in/nicole-purin-9a431/" target="_blank" rel="noreferrer noopener">Nicole Purin</a> its deputy general counsel, as the lawyer moves from her traditional finance roots into the world of Web3.



Based in Dubai, Purin joins OKX from Standard Chartered Bank, where she was senior legal counsel of financial markets for Africa and the Middle East.



Purin, who specializes in derivatives, structured finance, capital markets and securitization transactions, has also held roles at BNP Paribas, Mayer Brown and Goldman Sachs.



Moonstake has nabbed the former head of marketing operations at crypto derivatives exchange BitMEX to be its chief marketing officer.



<a href="https://www.linkedin.com/in/pietro-curto/?originalSubdomain=sg" target="_blank" rel="noreferrer noopener">Pietro Curto</a>, who spent about a year at BitMEX and nearly two years before that as a director at Markor Technology, is set to help the staking service provider grow.&nbsp;



Curto called Moonstake&#8217;s mission to create the largest staking pool in Asia, while also lowering the barrier of entry into the crypto market for beginners, is “an ambitious one.”&nbsp;



“I am confident that together, we will realize all of these ambitions and become a trusted and widely recommended platform for crypto users of any experience level,&#8221; he said in a statement.







Updated Nov. 20, 2022 at 5:01 pm ET: A previous version of this article stated that a member of FTX&#8217;s Global Payments team had removed his LinkedIn profile. This was based on a misunderstanding and was incorrect.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Employees Burned by FTX Enter a Tightening Market: Latest in Crypto Hiring

Bessie Liu

<div id="highlights-block_6345d9874d42c" class="highlights">
 <ul>
 <li>ParaSwap was alerted of the vulnerability early Tuesday by security firms</li>
 <li>The vulnerability, in a tool called Profanity, was exploited to drain $160 million from global crypto market maker Wintermute last month</li>
 </ul>
 
</div>



Blockchain security infrastructure company BlockSec confirmed <a href="https://twitter.com/BlockSecTeam/status/1579769525247279104" target="_blank" rel="noreferrer noopener">on Twitter</a> that decentralized exchange aggregator ParaSwap’s deployer address was vulnerable to what’s become known as the Profanity vulnerability.



ParaSwap was first <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368" target="_blank" rel="noreferrer noopener">alerted</a> of the vulnerability early Tuesday morning after Web3 ecosystem security team Supremacy Inc. learned that the deployer address was associated with multiple multi-signature wallets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ Hi <a href="https://twitter.com/paraswap?ref_src=twsrc%5Etfw">@paraswap</a> ,I heard that you want to see this? your deployer address private key may have been compromised (possibly due to Profanity vulnerability) and funds have been stolen on multiple chains.<a href="https://t.co/ijHaTwAj0l">https://t.co/ijHaTwAj0l</a>&mdash; Supremacy Inc. (@Supremacy_CA) <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368?ref_src=twsrc%5Etfw">October 11, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Profanity once was one of the most popular tools used to generate wallet addresses, but the project was abandoned due to <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">fundamental security flaws</a>. 



Most recently, global crypto market maker Wintermute was set back <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">$160 million</a> due to a suspected Profanity bug.



A Supremacy Inc. developer, Zach — who didn’t provide his last name — told Blockworks that Profanity generated addresses are vulnerable to hacks because it uses weak random numbers to generate private keys.



“If these addresses initiate transactions on the chain, exploiters can recover their public keys through transactions and then obtain the private keys by continuously back-propelling collisions on the public keys,” Zach told Blockworks via Telegram on Tuesday.



<blockquote class="wp-block-quote">“There is one and only one solution [to this problem], which is to transfer the assets and change the wallet address immediately,” he said.</blockquote>



After looking into the incident, ParaSwap said that no vulnerabilities were found and denied that Profanity generated its deployer.



Although it is true that Profanity did not generate the deployer, BlockSec co-founder Andy Zhou told Blockworks that the tool that generated ParaSwap’s smart contract was still at risk of Profanity vulnerability.



“They didn’t realize they used a vulnerable tool to generate the address,” Zhou said. “The tool did not have enough randomness which made it possible to crack the private key address.”



Knowledge of the vulnerability has also been able to help BlockSec recover funds. This was true for DeFi protocols BabySwap and TransitSwap, which were both attacked on Oct. 1.



“We were able to retrieve the funds and return them to the protocols,” Zhou said.



After noticing that some attack transactions had been front run by a bot susceptible to Profanity vulnerability, BlockSec developers were able to effectively steal from the thieves.



Despite its popularity as an efficient tool for generating addresses, the developer of Profanity <a href="https://github.com/johguse/profanity" target="_blank" rel="noreferrer noopener">cautioned</a> on Github that wallet security is paramount. “The code will not receive any updates, and I&#8217;ve left it in an uncompilable state,” the developer wrote. “Use something else!”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

The Bug That Took Down Wintermute Is Still at Large

<div id="highlights-block_6332c5ec82bae" class="highlights">
 <ul>
 <li>An external hacker wouldn’t have the knowledge required for contract execution, Edwards alleged</li>
 <li>Wintermute must clarify how the attacker had the necessary signature required, he said</li>
 </ul>
 
</div>



The $160 million hack of market maker Wintermute might have been an inside job, according to one blockchain analyst.



The liquidity provider, among the largest dedicated to crypto market making, was allegedly hacked due to a recently discovered “<a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">vanity address” vulnerability</a> in its DeFi (decentralized finance) operations. CEO Evgeny Gaevoy, who said the firm remained solvent, asked the hacker to get in touch and offered a 10% bounty if the funds were returned.



But a new theory by James Edwards, who goes by the name Librehash on Medium, claims the hack could be pinned down to Wintermute’s own team.



In a <a href="https://medium.com/@librehash_13479/analysis-of-the-wintermute-hack-an-inside-job-736422c08ef1" target="_blank" rel="noreferrer noopener">blog</a> posted on Monday, Edwards said the prevailing theory maintains that an externally owned address (EOA) behind the “compromised” Wintermute wallet was itself compromised because of a vulnerability in a vanity address generator tool. 



But he disputed that theory after analyzing the smart contract and its interactions, concluding that the knowledge required to go through with the hack rules out the possibility that the hacker was random or external.&nbsp;



Edwards noted that the smart contract at issue has “no uploaded, verified code,” which makes it difficult for external parties to confirm the external hacker theory and raises the issue of transparency.&nbsp;



<blockquote class="wp-block-quote">“The relevant transactions initiated by the EOA make it clear that the hacker was likely an internal member of the Wintermute team,” he wrote.</blockquote>



Further, on conducting an Etherscan analysis, he said the compromised smart contract received two deposits from Kraken and Binance’s hot wallets. “It&#8217;s safe to assume that such a transfer must have been initiated from team-controlled exchange accounts,” he said.



Less than a minute after the compromised Wintermute smart contract received over 13 million in Tether (the total amount of that token), the funds were sent from the wallet manually to a contract supposedly controlled by the hacker.



“We know the team was aware the smart contract had been compromised at this point. So why initiate these two withdrawals directly to the compromised smart contract smack in the middle of the hack?” he said on <a href="https://twitter.com/librehash/status/1574496083614613513" target="_blank" rel="noreferrer noopener">Twitter</a>.



Edwards believes the Wintermute team should provide an explanation of how the attacker would have the necessary signature for contract execution and know which functions to call, since there&#8217;s no contract source code published. He suggested only someone with intimate knowledge would have the capacity to do so.&nbsp;



Edwards is not a professional cybersecurity analyst and his blog on the Wintermute hack appears to be his debut Medium post. But he’s previously put out Twitter threads analyzing possible money laundering on various crypto projects.&nbsp;&nbsp;



The large scale theft was another blemish on the record of the industry as it would hurt the confidence of TradFi (traditional finance) institutions looking to enter the space, according to Marcus Sotiriou, analyst at GlobalBlock. “As Wintermute was one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss,” he said.



Wintermute didn’t return Blockworks’ request for comment by press time.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Was the $160M Wintermute Hack an Inside Job?

<div id="highlights-block_6329e5ceb56f8" class="highlights">
 <ul>
 <li>Bitcoin and ether extend losses following the Ethererum Merge and Wintermute hack</li>
 <li>The S&#038;P 500 and tech-heavy Nasdaq were also veering lower during Tuesday’s trading session, down 1% and 0.6%, respectively</li>
 </ul>
 
</div>



Cryptocurrencies and global equities are due for a volatile week amid ongoing turmoil in the digital asset space and ahead of various central banks’ monetary policy decisions.&nbsp;



Bitcoin briefly rose above $20,000 earlier in the week before falling to under $19,000 Tuesday. Ether lost 1.2%, falling below $1,300 for the first time since mid-July.



“Bitcoin and the crypto market saw a significant bounce Monday, before finding resistance at $19,666 – the 2017 bull market top, a key resistance,” <a href="https://www.linkedin.com/in/marcus-sotiriou-90a2a4192/?originalSubdomain=uk" target="_blank" rel="noreferrer noopener">Marcus Sotiriou</a>, analyst at the publicly listed digital asset broker GlobalBlock, wrote in a note Tuesday. “Investors are very cautious ahead of the Federal Reserve decision tomorrow.”



The S&amp;P 500 and tech-heavy Nasdaq were also veering lower during Tuesday’s trading session, down 1% and 0.6%, respectively.&nbsp;



Ether extended its loss from earlier in the month following the highly anticipated <a href="https://cms.blockworks.co/nft-artists-projects-celebrate-ethereum-merge-with-historic-mints/" target="_blank" rel="noreferrer noopener">Ethereum Merge</a>, which saw the second largest blockchain switch from proof-of-work to proof-of-stake. The currency has lost more than 7% in the past five days since the Merge’s successful completion early Thursday morning.



“We see a classic example of market psychology. Project quotes grew on expectations of a major event. In this case, many traders bought ETH in advance in order to sell on the increased hype by the principle of ‘buy the rumor, sell the fact,’” said Serhii Zhdanov, CEO crypto exchange EXMO. “Naturally, there were fewer buyers after the completion of the Merge.”



Zhdanov is confident that the price can turn around, especially given that a lower transaction cost means the network will be more accessible to users.&nbsp;



“This can increase the adoption of dapps working in the Ethereum ecosystem,” he added.&nbsp;



<h3>World braces for potentially bearish news</h3>



The volatility from last week shows no signs of slowing, with more market-moving events scheduled for the coming days



On Thursday, the Bank of Japan is slated to release its monetary policy decision, and the Bank of England will reveal its interest rate choice. Initial jobless claims in the US are also expected Thursday. Investors will be watching for indications of labor market strength to gauge the likelihood of a recession.&nbsp;



On the eve of the Fed’s September rate hike decision, futures markets predicted an 82% chance of a 75 basis point rate hike and an 18% chance of a 100 basis point increase, according to <a href="https://www.cmegroup.com/trading/interest-rates/countdown-to-fomc.html" target="_blank" rel="noreferrer noopener">data</a> from CME Group.



Crypto markets were also reeling Tuesday following reports that liquidity provider <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">Wintermute</a>’s DeFi operations had encountered a $160 million breach. The latest incident marks the firm’s second hack this year. In June, 20 million Optimism tokens were stolen by exploiting a <a href="https://cms.blockworks.co/20m-tokens-lost-as-market-maker-wintermute-takes-blame/" target="_blank" rel="noreferrer noopener">failed transaction</a> with Wintermute.



“This is a negative development within the DeFi space, and it will not help with the confidence of TradFi (traditional finance) institutions who are looking to enter the DeFi space,” Sotiriou said. “As Wintermute were one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Cryptos, Equities Slide on Central Bank Decisions, Merge Aftermath

<div id="highlights-block_63298f8951bb3" class="highlights">
 <ul>
 <li>A bug in vanity address generator Profanity suspected as attack vector, security experts say</li>
 <li>Stablecoins, the vast majority of the funds, have been deposited to Curve Finance, likely to evade blacklisting</li>
 </ul>
 
</div>



Liquidity provider Wintermute, which provides liquidity across most CeFi and DeFi exchanges, has suffered a major setback in a second security-based incident this year.&nbsp;&nbsp;



CEO Evgeny Gaevoy disclosed in a <a href="https://twitter.com/EvgenyGaevoy/status/1572134271011225601" target="_blank" rel="noreferrer noopener">Twitter thread</a> on Tuesday that the platform encountered a $160 million breach in its decentralized finance (DeFi) operations. The firm’s CeFi operations and over-the-counter services weren’t affected, he said.



Gaevoy indicated Wintermute remains solvent, with $320 million in equity left after the hack. Users can expect the platform to face disruptions over the next few days until operations return to normal.&nbsp;



The CEO said the firm is &#8220;open to&#8221; treating the situation as a white hat, referring to hackers that just test vulnerabilities in a system, as compared to malicious hackers. It’s not known whether that is the hacker&#8217;s intent.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We are (still) open to treat this a s a white hat, so if you are the attacker – get in touch&mdash; wishful cynic (@EvgenyGaevoy) <a href="https://twitter.com/EvgenyGaevoy/status/1572134291382960130?ref_src=twsrc%5Etfw">September 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Wintermute is among the largest crypto liquidity providers dedicated to crypto market making for exchanges including Binance and Coinbase.



The hack is already having knock-on effects, such as the <a href="https://twitter.com/bebop_dex/status/1572157679216525319" target="_blank" rel="noreferrer noopener">pausing of trading</a> on Bebob, an upstart DeFi dex using Wintermute&#8217;s market making services.



Tuesday’s incident marks the second time the firm was involved with a hack this year. In June, a hacker stole 20 million Optimism tokens by exploiting a <a href="https://cms.blockworks.co/20m-tokens-lost-as-market-maker-wintermute-takes-blame/" target="_blank" rel="noreferrer noopener">failed transaction</a> with Wintermute.



<h3>Security experts point to a known bug&nbsp;as Wintermute hack vector</h3>



Mudit Gupta, chief security officer at Polygon, guessed <a href="https://twitter.com/Mudit__Gupta/status/1572150289943363589" target="_blank" rel="noreferrer noopener">in a tweet</a> that the hack was a result of a hot wallet compromise due to the <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">Profanity bug</a> uncovered by 1inch contributors last week. 1inch had warned that wallet addresses generated using the Profanity tool were at risk of compromise.



“If you used Profanity to get a vanity smart contract address, make sure to change the owners of that smart contract,” 1inch staff wrote in a Sept. 15 <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">blog post</a>.



The contributors noted that Profanity’s popularity didn’t mean it wasn’t without defect, and that its vulnerability enabled hackers to “secretly” steal tens of millions of dollars from users’ wallets.



<blockquote class="wp-block-quote">“It’s not a simple task, but at this point it looks like tens of millions of dollars in cryptocurrency could be stolen, if not hundreds of millions,” they said in the post.</blockquote>



The <a href="https://debank.com/profile/0xe74b28c2eae8679e3ccc3a94d5d0de83ccb84705" target="_blank" rel="noreferrer noopener">Ethereum address</a> associated with the Wintermute hack held nearly $13 million in wrapped bitcoin (WBTC) and $9.3 million in ETH, among other tokens including matic, DYDX and FTX tokens as of 6:15 am ET on Tuesday.



Most of the stolen funds — $114 million in USDC and USDT stablecoins — have been moved to Curve Finance flagship “3Crv” liquidity pool. That may make it harder for centralized stablecoin issuers Circle and Tether to freeze the tokens, as they are commingled within the $869 million pool.



A Tether spokesperson told Blockworks that the firm is ready to collaborate in any investigation that law enforcement will initiate to help in the recovery of such funds.



Gaevoy didn’t specify when the hack took place or how it happened. In a <a href="https://twitter.com/EvgenyGaevoy/status/1572329658636537857">later tweet</a>, he offered the hacker a 10% bounty on the funds if returned. Wintermute and Circle didn’t return Blockworks’ request for comment by press time.



This story was updated on Sept. 20 at 11:42 pm ET.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Wintermute Whacked by $160M Hack Exploiting Known Vulnerability

<div id="highlights-block_62a11c5d87f7a" class="highlights">
 <ul>
 <li>A hacker has acquired 20 million Optimism governance tokens intended for a loan</li>
 <li>The attacker has since transferred or sold about one million tokens — but that’s likely just the start</li>
 </ul>
 
</div>



The airdrop of first-time governance tokens from Ethereum scaling solution Optimism has gone awry in a major way — thanks to a third-party the collective tapped to provide liquidity.



All told, about 20 million Optimism governance tokens (OP) that were loaned to facilitate transactions were lost, with cryptocurrency market maker Wintermute taking responsibility for the lapse.



The loan was initially deployed on Wintermute’s wallets on Optimism, but Wintermute CEO Evgeny Gaevoy said in a <a href="https://gov.optimism.io/t/message-to-optimism-community-from-wintermute/2595" target="_blank" rel="noreferrer noopener">statement</a> that “we made a serious error.” 



Here’s what happened: The wallet address Wintermute used to receive the loan was inaccessible, because it relied on Ethereum layer-1 multi-signature technology that had yet to be deployed to Optimism, which runs as a layer-2. A layer-1 is the foundational function of a given blockchain, while layer-2s are built on top, typically to provide new features or liquidity.



A hacker, meanwhile, took advantage of the technological lapse to transfer the 20 million OP tokens from layer-1 to layer-2, even as Wintermute scrambled to recover the in-limbo funds. The attacker, however, had as of publication only liquidated about a million of the stolen tokens.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">More important is what they knew and when. They knew about this on May 30th. There was a 15 hour gap between the test transaction of 1 <a href="https://twitter.com/search?q=%24OP&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$OP</a> and the following transaction. They didn&#39;t notice something was wrong? They knew 1 million was dumped on 6/5. Did exchanges know about this?&mdash; Benjamin Singer (@BenjaminSinger8) <a href="https://twitter.com/BenjaminSinger8/status/1534657594836627457?ref_src=twsrc%5Etfw">June 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“L1 is confusing enough for most people to navigate, and L2 brings a new set of paradigms over key management and safety, even for experienced crypto users and teams,” Gaevoy said.&nbsp;



“We are not sure why they chose not to liquidate all of it at once,” Gaevoy said. “There is hope that it is a white hat exploit, in which case the remaining funds are potentially recoverable. However we are currently operating under the premise that it is not the case, since we haven’t received any communication from them and our message on the chain was left unanswered.”



The attacker still owns 19 million OP tokens. Wintermute said the company plans to buy back the tokens once the attacker sells, saying the purchase “can potentially create price volatility in the token,” but that the market maker will “make best efforts to smoothen the effect.”



The Optimism Foundation has not chosen to update its network — likely requiring a hard fork — to halt the movement of stolen OP tokens that have not yet been stolen or sold as the foundation believes that “using centralized control to attempt a partial recovery would set a significant precedent.”



Security flaws and the illicit process of attaining cryptoassets have become a common problem for many platforms, and <a href="https://cms.blockworks.co/bipartisan-crypto-bill-hits-congress-with-focus-on-cftc-jurisdiction-taxes/" target="_blank" rel="noreferrer noopener">lawmakers are eager</a> to look for solutions.



It comes down to the hallmark phrase, “Not your keys, not your coins,” Ashton Wolfe, the project lead of Crypto Fight Club, told Blockworks.



“Of course, to protect people&#8217;s assets, governments will think that continuously hammering down on regulations will fix this solution,” Wolfe said. “Unfortunately, this still hasn’t worked, because it is a very slow process, and users resent uploading private documents to these counter-parties in order to use the platform.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

In Latest Crypto Hack, 20M Tokens Lost as Market Maker Wintermute Takes Blame

Jacquelyn Melinek

<div id="highlights-block_6227ad008c97c" class="highlights">
 <ul>
 <li>Avalanche Multiverse’s program and investments will be divided into at least six phases to support new cohorts and projects</li>
 <li>Up to four million AVAX tokens will fund the program</li>
 </ul>
 
</div>



A non-profit fund for the Avalanche blockchain has rolled out an incentive program with millions of dollars earmarked for the proof-of-stake ecosystem.



Up to four million AVAX tokens, or about $290 million at the time of publication, will fund the program, also known as Avalanche Multiverse. 



The initiative will aim to grow its “subnet” functionality, which helps develop application-specific blockchains on Avalanche. Subnets are natively integrated with Avalanche’s broader ecosystem, available in an unlimited supply and allow for custom implementations — or the ability to tack on features from other chains.



Avalanche Multiverse’s program and investments will be divided into at least six phases to support new cohorts and projects but will not be constrained to a specific time period.&nbsp;It&#8217;s a non-profit organization that is run separately from Ava Labs. 



The first subnet to receive an investment from the program is DeFi Kingdoms, an NFT gaming project. It will get up to $15 million in incentives through AVAX tokens, as well as the game’s new Avalanche-native token CRYSTAL and existing token JEWEL.



Ava Labs, a core developer of Avalanche, will also partner with the Aave Companies, GoldenTree Asset Management, Wintermute, Jump Crypto, Valkyrie, Securitize and other organizations to build the subnet. This will allow regulated institutions that participate to leverage its subnets and access institutional DeFi (decentralized finance) after completing know-your-customer (KYC) checks.



“Avalanche Subnets enable us to create an ideal environment for institutions to migrate on-chain and experience the power of DeFi protocols first-hand as users rather than just as investors,” Stani Kulechov, founder and CEO of Aave, said in a statement. “This is a significant leap toward a future where the barriers between traditional and decentralized finance cease to exist.”



In November, Avalanche launched a <a href="https://cms.blockworks.co/avalanche-launches-200m-fund-to-support-ecosystem-growth/" target="_blank" rel="noreferrer noopener">$200 million fund</a> to support ecosystem growth on its blockchain. It also closed a <a href="https://cms.blockworks.co/?s=avalanche#:~:text=Avalanche%20Closes%20%24230M%20Token%20Sale%20Backed%20by%20Three%20Arrows%20Capital%2C%20Polychain" target="_blank" rel="noreferrer noopener">$230 million token sale</a>, backed by Three Arrows Capital and Polychain, a few months prior.&nbsp;



Avalanche’s native token, AVAX, had a price of $75.39 as of 1:30 pm ET on Tuesday, according to CoinMarketCap <a href="https://coinmarketcap.com/currencies/avalanche/" target="_blank" rel="noreferrer noopener">data</a>. The coin’s market capitalization is near $19.9 billion, which ranks the token as the 10th largest cryptocurrency, behind Solana (SOL) and ahead of Binance USD (BUSD), the data show.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">