Ben Strack

Amid the shifting regulatory landscape, crypto firms are expanding their US footprint and ramping up hiring across policy, compliance, and go-to-market roles.



Companies looking to capitalize on <a href="https://blockworks.co/news/washington-dc-blockchain-summit-takeaways">US opportunities</a> are hiring policy and compliance pros, as well as leaders focused on “go-to-market” strategies, recruiters told Blockworks.  



Wintermute became the latest to reveal a new US headquarters on Thursday. The crypto-focused trading firm’s New York office will focus on business development and partnerships, a spokesperson told Blockworks — with managing director David Micley leading those efforts.&nbsp;



Ron Hammond, a former government relations director at Blockchain Association, is set to lead Wintermute’s policy engagement in the United States.



Wintermute currently employs about 100 people in London and 25 people in Singapore. Its projected US headcount for this year is 10, with Wintermute CEO Evgeny Gaevoy telling Blockworks the firm plans to add policy, legal and compliance leaders in New York.



“The US is at a pivotal moment in shaping digital asset market structure,” Gaevoy said. “While we remain policy agnostic, this is the right time to be part of the conversation and offer our expertise.” On the commercial side, being “on the ground” allows Wintermute to engage directly with new and existing counterparties, the CEO explained.



While London and Singapore have historically offered clearer crypto regulatory frameworks than the US, the new office “follows the country’s greater openness toward digital asset innovation and large financial institutions’ accelerated adoption of the asset class,” Gaevoy added.



Wintermute’s New York office announcement came a couple weeks after MoonPay said its new 5,000 square-foot space in Manhattan would be the “central hub” for its growing US staff.



MoonPay now has roughly 70 people in the US, representing about 20% of its global workforce. That is second only to the UK, where the company opened its largest office last year.



Keith Grossman, MoonPay’s president of enterprise, is set to lead the New York City office, a spokesperson told Blockworks. Espi Elio, a VP of operations, and Treasurer Derek Yu will also be based there, along with the company’s directors of social media, engineering, solutions engineering, partnerships and accounting.



The New York office will be the base for various MoonPay legal professionals too, including two of its deputy general counsels. The company is looking to fill a <a href="https://jobs.lever.co/moonpay/539ada88-7654-4885-b7c4-f0036e0b7195">position</a> for a senior product director focused on stablecoins as well.



“We plan to hire across a range of roles, which may include product, compliance, operations, engineering and more,” the representative added.



Just as Wintermute and MoonPay cited US regulatory developments as a reason to open a new site, so too did Crypto.com upon last week opening its new Washington DC office. That location will focus on public and government affairs work, the company noted in a May 7 release.



Matt David, the company’s North America President and Chief Corporate Affairs officer, called the US market “the most exciting frontier for our entire industry” in a statement.



This new office follows the crypto platform last year creating a North American headquarters in Tyler, Texas.



A company spokesperson declined to comment further.&nbsp;



<h2 class="wp-block-heading">Building out US workforces</h2>



WorkInCrypto.Global founder Sam Wellalage said many of his European clients are thinking about how to boost their presence in the US.&nbsp;&nbsp;



“There’s a growing sense of urgency, partly driven by the perception that Trump-era policies and ongoing de-regulation are making it easier for crypto businesses to set up in the US and acquire both retail and institutional customers more quickly,” he said.



Wellage added: “It’s also widely acknowledged that the US has access to some of the best crypto talent globally.”



The most common roles Wellalage has helped clients fill have been what he called “go-to-market” positions. Those include sales directors, as well as heads of commercial and heads of revenue roles.&nbsp;&nbsp;



“Marketing roles like growth marketing and digital marketing are also in high demand,” he said.



Zachary Plotkin, a managing partner at recruiting firm Madison-Davis, said most of the small and midsize crypto companies he’s seeing expand to the US are looking for technology, compliance, risk and data security professionals.



“I have noticed that more of these firms are willing to hire a temporary chief compliance officer, a temporary chief risk officer or temporary [Bank Secrecy Act] officer that can handle the load of the work to see if the firm&#8217;s US footprint can expand,” he said.



Crypto exchange OKX, which last month debuted its US headquarters in San Jose, California, is searching for a US-based head of risk strategy, a head of product compliance and a senior compliance manager focused on anti-money laundering investigations.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

crypto hiring

As crypto firms boost US footprint, the race for talent is on

Jack Kubinec

A group of seven Uniswap DAO delegates who vote over 80% of the time — but possess marginal voting power —&nbsp;moved closer to receiving a voting power boost after a Wednesday temperature check vote.&nbsp;



The proposal would split 10 million uniswap, worth around $60 million at current prices, among “underrepresented” DAO delegates with less than 2.5 million uniswap. A DAO borne out of Georgia Tech’s blockchain club and the trading firm Wintermute were the two most popular delegates in the temp check. 



The <a href="https://gov.uniswap.org/t/temperature-check-delegation-of-uni-to-active-but-underrepresented-delegates/22238?u=doo_stablelab">proposal</a> now faces an on-chain vote before delegates would receive uniswap (<a href="https://blockworks.co/price/uni">UNI</a>) from the DAO’s treasury. To be clear, the UNI would not be funds the delegates could spend or trade, but would bump up their share of voting power on future governance matters.&nbsp;



As with many <a href="https://blockworks.co/tag/daos">DAOs</a>, Uniswap’s DAO allows token holders to either vote themselves or <a href="https://docs.uniswap.org/concepts/governance/guide-to-voting#:~:text=Delegation%E2%80%8B&amp;text=Delegating%20UNI%20binds%20the%20voting,best%20interest%20of%20Uniswap%20Governance.">delegate</a> their voting power to another wallet address. There are more than 30 delegates with at least 2.5 million delegated votes, the line the proposal sets for “underrepresented.” Variant Fund general partner Jesse Walden is the second-<a href="https://sybil.org/#/delegates/uniswap">largest</a> delegate with around 8 million tokens.



Read more: <a href="https://blockworks.co/news/uniswap-dao-vc-governance">Uniswap’s DAO poised to try its hand at venture capital</a>



The governance service provider StableLab authored the delegation proposal and would also receive governance tokens were it to pass. StableLab also proposed and <a href="https://www.tally.xyz/gov/rari-foundation/proposal/66726109600671652856639226642372993908424788433801728846371611962551475607579?chart=0">passed</a> a delegation incentive program this week at Rari DAO.



Doo Wan Nam, chief operating officer of StableLab, told Blockworks that the experiment in recognition for active delegates is important for accountability, as delegates who failed to maintain 80% participation would lose the extra votes.&nbsp;



Wan Nam acknowledged the difficulty in subjectively analyzing whether an active voter is a good voter, though. Are delegates voting flippantly or deeply researching both sides of a proposal?&nbsp;



“We have to start with something that’s objective,” Wan Nam said. 



The move comes as Uniswap’s voting delegation has been slowly consolidating. A Dune Analytics dashboard <a href="https://dune.com/butterd/uniswap-governance-power-structure">shows</a> that in 2023, the number of votes cast per governance proposal has stayed more or less constant while the number of voters participating has generally declined.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

DAOs

Uniswap DAO to weigh giving ‘underrepresented’ delegates more voting power

Bessie Liu

Macauley Peterson

Wintermute founder and CEO Evgeny Gaevoy has publicly accused Near Foundation and Aurora Labs for failing to uphold a deal which would see $11.2 million worth of USN, a Near protocol-native stablecoin, convert to USDT.



Gaevoy said Wintermute, which acquired the USN tokens from the <a href="https://blockworks.co/tag/alameda-research">Alameda Research</a> estate, made a deal to participate in the redemption under the preexisting <a href="https://pages.near.org/blog/statement-in-full-near-foundation-to-fund-usn-protection-programme/">USN Protection Program</a> (USNPP) designed by Near Foundation after the developer Decentral Bank <a href="https://blockworks.co/news/near-nixes-algorithmic-stablecoin-usn">decided to sunset the stablecoin</a> in October 2022.



Aurora Labs was responsible for setting up the program after receiving a grant from the Near Foundation.&nbsp;



According to Gaevoy in a <a href="https://twitter.com/EvgenyGaevoy/status/1722019058717986903">post on X</a>, Wintermute was tasked with facilitating the selling of an estimated 11.2 million in USN to FTX creditors under the assumption that they would later be able to redeem USN for USDT on a 1-1 basis.&nbsp;



“This confidence was based on public statements by NF, Near introducing us to Aurora and Aurora confirming in private chats that they can facilitate the redemption, in our specific case, in a couple of days,” Gaevoy <a href="https://twitter.com/EvgenyGaevoy/status/1722019058717986903">wrote</a>.&nbsp;



Aurora responded with a <a href="https://aurora.dev/blog/our-response-to-wintermute-s-claim">blog post</a> calling the claims “unfounded,” and asserting that Wintermute “tried to use the USN Protection Programme (USNPP) in a way that ran counter to its purpose and the terms of use.”



Gaevoy claimed that <a href="https://blockworks.co/tag/near-foundation">Near Foundation</a> did not honor commitments made, and the team was only offered 20% of the amount they were initially promised.



Aurora rebutted the claim, saying “[Wintermute’s] redemption request was inconsistent with the intended purpose of the USNPP,” and therefore declining the request, a decision made in consultation with the Near Foundation, was legitimate.



Gaevoy further noted that Wintermute offered alternative solutions, such as using the funds to buy and lock <a href="https://blockworks.co/tag/near">Near</a> tokens (<a href="https://blockworks.co/price/near">NEAR</a>), but received no cooperation from the Near Foundation team.



“The resulting loss would have been easy to sweep under the rug. Nevertheless, I made a decision to disclose this in the public interest, because I strongly believe it is my role to act in the best interests of the industry beyond the immediate commercial interest at hand,” Gaevoy wrote.



Near Foundation has not responded to Blockworks request for comment at time of publication. On Tuesday, coinciding with the start of the NEARCON conference in Lisbon, the foundation <a href="https://near.org/blog/enter-the-black-dragon-near-co-founder-joins-the-near-foundation-as-ceo">announced</a> that Near co-founder was appointed as CEO. He previously <a href="https://near.org/blog/illia-polosukhin-returns-to-near-foundation-council-to-continue-evolution-of-near-ecosystem-diogo-monica-founder-of-anchorage-joins-as-chairman">re-joined</a> the Near Foundation Council in October.



Gaevoy said that Wintermute will be pursuing legal action against both teams and that Wintermute is “fully committed to switching into a full-time adversarial mode.”



According to Gaevoy, Wintermute has no trading position on NEAR, however the NEAR token is down about 3% over the past 24 hours.



“Entering into a short position, though potentially worth the effort, would significantly dilute the overall message,” he <a href="https://x.com/EvgenyGaevoy/status/1722019542220607602?s=20">said</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

NEAR

Wintermute CEO accused Near Foundation of failing to redeem stablecoins

Shalini Nagarajan

Companies across crypto are more determined than ever to hire experts and hold onto top talent after a brutal year.



With a long-term vision of the industry’s potential, many firms (even non-crypto natives) are looking to expand their services by bringing in crypto, decentralized finance and blockchain specialists.



All this while industries around the world, especially the tech sector, have been hit with wave after wave of layoffs. Many skilled workers are left searching for their next move.&nbsp;



Here are some companies that have several crypto and blockchain-related job openings:



<h2 class="wp-block-heading">Bitget</h2>



Crypto exchange Bitget doubled its workforce to 1,300 in the last year. It says it built its business strategy with potential negative scenarios in mind.



The company is ambitiously expanding into emerging markets like Africa and Latin America, providing exciting opportunities for local experts. With regional centers already established in Asia and Latin America, it’s now eyeing talented individuals to join the team.&nbsp;



Currently, more than 36 open job positions are listed on <a href="https://www.linkedin.com/jobs/search/?currentJobId=3569715892&amp;f_C=69884978&amp;geoId=92000000&amp;keywords=bitget&amp;location=Worldwide&amp;refresh=true">LinkedIn</a>, but a representative for the firm said 300 positions are open with a major focus on user experience, compliance and Web3 careers.&nbsp;



<h2 class="wp-block-heading">Wintermute</h2>



Wintermute is an algorithmic trading firm that provides liquidity to crypto markets.&nbsp;



It also provides market-making services and teams up with exchanges and other market participants to boost liquidity into the crypto ecosystem.&nbsp;



Recruitment platform <a href="https://jobs.lever.co/wintermute-trading">Lever</a> shows the firm has at least 15 open job postings based in London and Singapore.



<h2 class="wp-block-heading">Sky Mavis</h2>



Axie Infinity creator Sky Mavis is on the lookout for top-notch experts in game development, blockchain engineering and marketing to join their team.&nbsp;



The video game developer has nearly 30 open positions in Vietnam, Singapore and the US, according to hiring platform <a href="https://apply.workable.com/sky-mavis/?lng=en">Workable</a>.



<h2 class="wp-block-heading">Uniswap</h2>



Uniswap, Ethereum’s top decentralized exchange, is one of the most popular DeFi protocols.&nbsp;



Since 2018, the platform has serviced the crypto ecosystem with a user-friendly dapp for token swaps.&nbsp;



Uniswap is currently on the hunt for talented individuals who can help them stay ahead of the curve, and <a href="https://www.linkedin.com/jobs/uniswap-labs-jobs-worldwide/?currentJobId=3584657543">LinkedIn</a> shows at least 12 open job positions in engineering-based roles.



<h2 class="wp-block-heading">MultiversX (formerly Elrond)</h2>



Blockchain platform MultiverseX, which rebranded from Elrond in late 2022, is eager to keep building out metaverse infrastructure.



MultiverseX is looking to expand its ecosystem and forge new partnerships, which means exciting career opportunities for professionals with expertise in blockchain development.&nbsp;



The firm’s <a href="https://multiversx.com/careers">website</a> shows at least 15 open positions in backend and frontend development, business development, marketing and UI/UX design.



<h2 class="wp-block-heading">Deloitte</h2>



Multinational professional services firm <a href="https://blockworks.co/tag/deloitte" target="_blank" rel="noreferrer noopener">Deloitte</a> provides services including consulting, audit, tax and advisory services to clients across industries.



It’s known for its expertise in financial and risk management and digital transformation. The ‘Big Four’ auditor currently has <a href="https://blockworks.co/news/deloitte-crypto-hiring-spree">331 open job positions</a> on LinkedIn, including tax advisory services.



<h2 class="wp-block-heading">EY</h2>



Fellow accounting giant EY similarly offers consultancy services like audit, tax compliance, transaction advisory and performance improvement.&nbsp;



The company has an extensive selection of job openings for blockchain-related positions in China, Hong Kong, the US and Spain, as stated on its <a href="https://careers.ey.com/ey/search/?q=blockchain&amp;startrow=25">website</a>.



<h2 class="wp-block-heading">Ripple</h2>



San Francisco-based Ripple, the blockchain tech company that constantly makes headlines about its <a href="https://blockworks.co/news/sec-court-win-weakens-ripple-argument">ongoing legal battle with the SEC</a> over <a href="https://blockworks.co/price/xrp">XRP</a>, has strategically expanded into the Asian market, particularly in Japan, South Korea and Thailand.&nbsp;



It currently has more than <a href="https://ripple.com/careers/all-jobs/">55 open job listings</a> in Toronto, San Francisco, Bangalore, London and Singapore.



<h2 class="wp-block-heading">Coinbase</h2>



Coinbase is also in <a href="https://blockworks.co/news/coinbase-warns-sec-litigation">hot water with the SEC</a> over potential violations of securities laws.&nbsp;



But that hasn’t stopped the top US crypto exchange from wanting to grow, as the company has almost <a href="https://www.coinbase.com/careers/positions">60 job listings</a> up for grabs — and many of them are in engineering.



<h2 class="wp-block-heading">Binance</h2>



Binance, the world’s largest crypto exchange by trade volume, recently got into trouble for failing to register properly with US financial authorities.&nbsp;



However, the crypto exchange still has over <a href="https://www.binance.com/en/careers/job-openings">380 job listings</a> up for grabs in locations around the world.&nbsp;



A bunch of the open roles are in legal and compliance.



<h2 class="wp-block-heading">How to break into the Web3 job market</h2>



It’s good to know which skills are in high demand. Front-end wizards with a knack for HTML, CSS and JavaScript are a hot commodity, according to Tyler Feinerman, global head of talent at crypto-focused comms agency Wachsman.



And those who can navigate the complex world of Solidity, Node.js, Python, Go, Rust and Scala are worth their weight in bitcoin.



User experience developers are also some of the most sought-after candidates in the industry right now. Many companies — both Web2 and Web3 — have realized clunky interfaces turn away many users.



“As the industry gets progressively crowded, user experience has become a differentiator for crypto-native companies and corporations venturing into the space,” Feinerman said.



She warned that some companies may be struggling to identify and properly evaluate talent, and may end up overlooking star candidates in the process.



So, ready to take the plunge? Don’t let fear of the unknown hold you back.



“The reality is, we are all learning and we are still only at the very beginning. Dive in head-first, accept that there will be a steep learning curve and embrace the inevitable challenges along the way, because it is genuinely such an exciting space to be part of,” Feinerman said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Bitget

No Bear Market for Crypto Talent: These 10 Companies Are Hiring Now

James Cirrone

Market making firm Wintermute will serve as the liquidity provider for ETC Group’s new crypto ETP called DA20, or the MSCI Digital Assets Select 20 ETP.  



DA20 was launched on Monday and will track the performance of the MSCI Global Digital Assets Select Top 20 Capped Index, which represents a basket of the 20 leading digital assets. Bitcoin (<a href="https://blockworks.co/price/btc">BTC</a>), ether (<a href="https://blockworks.co/price/eth" target="_blank" rel="noreferrer noopener">ETH</a>) and solana (<a href="https://blockworks.co/price/sol" target="_blank" rel="noreferrer noopener">SOL</a>) are among the tokens tracked by the index and included in DA20. 



The new investment product will first be listed on German stock exchange Xetra, and it will be physically backed. The assets will be held by Komainu, a crypto custody solution that recently <a href="https://blockworks.co/news/crypto-custodian-komainu-follows-exchanges-to-dubai">set up shop in Dubai</a>, per the release.



DA20 is primarily being considered for institutional investors, according to Evgeny Gaevoy, CEO and co-founder of Wintermute.



“By leveraging our ability to offer competitive liquidity for high-volume crypto trades, investors will know that they are able to best take advantage of any market presented by the DA20,” Gaevoy said in a statement. “We are confident that this product will satisfy the demands of institutional investors, further bridging the gap between the crypto and traditional markets.”&nbsp;



The index that DA20 tracks was developed by MSCI and ETC Group in early March. It doesn’t include stablecoins, pegged coins or privacy coins. It also doesn’t include what it deems “memecoins,” per the index’s <a href="https://www.msci.com/eqb/methodology/meth_docs/MSCI_Global_Digital_Assets_Select_Top20_Capped_20230301.pdf">methodology</a>.



Additionally, MSCI said it will conduct a review every quarter to determine whether the components of the index need to be weighted differently based on the relative daily return performance in US dollars. These reviews will be announced five business days in advance, the methodology states.



Wintermute, which will be responsible for DA20 trade operations, was the victim of <a href="https://blockworks.co/news/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability">a $160 million breach of its DeFi services</a> in September 2022. At the time, Blockworks reported that the firm’s CeFi operations and over-the-counter services remained clean.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

ETFs

ETC Group Taps Wintermute to Provide Liquidity for Crypto ETP

The California Department of Financial Protection and Innovation (DFPI) has issued fraud alerts about phony entities posing as decentralized exchange Uniswap and crypto market maker Wintermute.



The alerts came alongside posts for 14 other registered entities apparently peddling crypto-themed Advance Fee scams.



In one instance, the victim <a href="https://dfpi.ca.gov/2022/12/27/cryptocurrency-broker-uniswap-llc-appears-to-be-engaged-in-fraud-against-california-consumers/" target="_blank" rel="noreferrer noopener">claimed</a> a &#8220;UniSwap LLC&#8221; lured them into investing $14,000 in what was presented as a Uniswap liquidity mining venture.



Per DFPI: “The victim met a person calling themselves &#8216;Heitor Ryan&#8217; on the internet who claimed to work at a bank. They chatted as friends for several months, then Heitor lured the victim into investing on a crypto website that turned out to be a fraud.”



Another victim in a <a href="https://dfpi.ca.gov/2022/12/27/cryptocurrency-website-eth-wintermute-net-appears-to-be-engaged-in-fraud-against-california-consumers/" target="_blank" rel="noreferrer noopener">separate</a> scam was convinced to send more than $167,000 to who they believe was crypto trading outfit Wintermute.



“The victim met someone calling herself ‘Rosalie’ on WhatsApp, who introduced him to eth-Wintermute dot net, telling the victim this would generate dividends on liquidity pools every six hours based on the amount of money put into the MetaMask app wallet,” DFPI wrote (Blockworks advises caution when interacting with the quoted domain).



Phishers and other bad actors commonly spoof popular crypto platforms to <a href="https://blockworks.co/news/crypto-trading-bot-platform-3commas-rocked-by-critical-api-leak" target="_blank" rel="noreferrer noopener">target digital asset investors</a>. Users are advised to always triple check the domains they interact with. 



But 2022 will perhaps go down as the biggest year of crypto-related frauds in history so far, thanks in no small part to the Sam Bankman-Fried case.



Between January to November, investors lost more than $4 billion worth of crypto — a 37% jump from last year, according to a <a href="https://www.privacyaffairs.com/cryptocurrency-scams-2022/">study</a> by Privacy Affairs.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

California

Fake Uniswap, Wintermute Reps Con Californian Crypto Curious

Casey Wagner

Topping off an already tumultuous year for cryptocurrency prices and company blowups, 2022 was a record year for crypto hacks.&nbsp;



From January 2022 to November 2022, hackers made off with $4.3 billion of cryptocurrency, up 37% from the same period in 2021, according to <a href="https://www.privacyaffairs.com/cryptocurrency-scams-2022/" target="_blank" rel="noreferrer noopener">data</a> from cybersecurity firm Privacy Affairs. Analysts at Solidus Labs estimate bad actors are launching up to 15 crypto-related scams per hour. 



We’ve rounded up the top hacks of the year — so far. 



<h3 class="wp-block-heading">Axie Infinity’s Ronin Network — $625 million </h3>



Coming in at the biggest breach of the year, hackers made off with more than $600 million from <a href="https://blockworks.co/tag/ronin" target="_blank" rel="noreferrer noopener">Ronin Network</a>, an Ethereum-linked sidechain used for blockchain game Axie Infinity in <a href="https://blockworks.co/news/sky-mavis-ronin-network-bridge-exploited-for-over-600m" target="_blank" rel="noreferrer noopener">March</a>. Exploiters, the network said, used hacked private keys to forge withdrawals on March 23. The breach wasn’t discovered until almost a week later, when a user was unable to withdraw 5,000 ETH.



Later, Sky Mavis, the company that built the bridge, <a href="https://twitter.com/trungfinity/status/1511416163313414147" target="_blank" rel="noreferrer noopener">acknowledged</a> that it may have sacrificed security for speed when developing the bridge. Sky Mavis then announced a $150 million raise, led by Binance, to reimburse affected users. Other contributors to the round included Paradigm, Animoca Brands, Dialectic, Accel and Andreesen Horowitz.



<h3 class="wp-block-heading">Wormhole Bridge — $320 million </h3>



In February, hackers targeted <a href="https://blockworks.co/tag/wormhole" target="_blank" rel="noreferrer noopener">Wormhole</a>, one of the largest cross-chain bridges between Solana and other blockchains. The bad actors exploited a vulnerability in Wormhole’s validation system, allowing them to make off with fraudulently generated wrapped ether. 



Hackers then used the chain to convert the wrapped ether into ether. Wormhole <a href="https://blockworks.co/news/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses" target="_blank" rel="noreferrer noopener">parent company</a> Jump Crypto later replaced all 120,000 ether the bridge lost. 



<h3 class="wp-block-heading">Nomad Bridge — $190 million </h3>



In August, DeFi bridge <a href="https://blockworks.co/tag/nomad" target="_blank" rel="noreferrer noopener">Nomad</a> lost $190 million in a hack that involved 960 transactions and 1,175 individual withdrawals. Users were able to exploit a bug in the protocol that allowed them to withdraw more than they had deposited. 



It is thought that once news of the bug spread, users rushed to exploit it themselves, resulting in a free-for-all involving onlookers rushing to submit illicit transactions, quickly draining the token bridge of all user funds kept inside its associated smart contract.



White hat hackers later returned at least $32 million to a recovery wallet address, <a href="https://blockworks.co/news/nomad-recovers-nearly-20m-of-stolen-190m" target="_blank" rel="noreferrer noopener">Nomad said</a>. The wallet was set up in association with custodian bank, Anchorage Digital. 



<h3 class="wp-block-heading">Beanstalk Farms — $182 million </h3>



Ethereum-based stablecoin protocol <a href="https://blockworks.co/tag/beanstalk" target="_blank" rel="noreferrer noopener">Beanstalk</a> lost $182 million in April when a hacker used a flash loan to buy a majority position in STALK, the protocol’s native governance token. The hacker then proposed a massive transfer of funds and approved it using their own majority vote. 



Nearly four months after the breach, the algorithmic stablecoin protocol relaunched. Beanstalk Farms <a href="https://blockworks.co/news/algo-stablecoin-protocol-beanstalk-relaunches-following-180m-hack" target="_blank" rel="noreferrer noopener">said it “unpaused” its services</a> on the one-year anniversary of its original August 2021 launch.



<h3 class="wp-block-heading">Wintermute — $160 million </h3>



In September, Liquidity provider <a href="https://blockworks.co/tag/wintermute" target="_blank" rel="noreferrer noopener">Wintermute</a>, which provides liquidity across most CeFi and DeFi exchanges, said it lost $160 million in a security breach. Wintermute is among the largest crypto liquidity providers, conducting market making services for exchanges including Binance and Coinbase.



There is <a href="https://blockworks.co/news/was-wintermute-160m-hack-an-inside-job" target="_blank" rel="noreferrer noopener">speculation that the hack was an inside job</a>, but no cause or perpetrator has been confirmed.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Axie Infinity

Crypto Thieves Made Off With $4.3B in 2022: Top Hacks of the Year

With crypto exchange FTX <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">filing for bankruptcy</a> last week and other large industry players — such as <a href="https://blockworks.co/news/blockfi-eyes-bankruptcy-as-ftx-fallout-continues-report" target="_blank" rel="noreferrer noopener">BlockFi</a>, <a href="https://blockworks.co/news/genesis-halts-lending" target="_blank" rel="noreferrer noopener">Genesis</a> and <a href="https://blockworks.co/news/gemini-circle-genesis-exposure" target="_blank" rel="noreferrer noopener">Gemini</a> — enduring shockwaves of the collapse, talent is flooding the space but chasing a dwindling number of spots.



Crypto doesn’t have enough positions for all the people in the segment who have lost their jobs, <a href="https://workincrypto.global/" target="_blank" rel="noreferrer noopener">WorkInCrypto.Global</a> founder Sam Wellalage told Blockworks.&nbsp;



Despite that, Wellalage said based on meetings he had at the TOKEN2049 conference in London last week, plenty of companies are still hiring.&nbsp;



“All my 300 business cards were taken by companies and candidates,” he said. “It is wild. We expect to be very busy.”



Ex-FTX staff in the lurch



FTX employees have begun or are looking to scatter following the exchange <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">filing for bankruptcy</a> last week, and the Wall Street Journal Tuesday reported that BlockFi was planning staff cuts as it considers initiating Chapter 11 bankruptcy.&nbsp;



“A lot of the trust I have placed in society has vanished,” a recent employee of FTX told Blockworks in a message. “I still need time to process everything.”



Wellalage said Tuesday he had so far spoken to seven candidates that day from companies including FTX and BlockFi. He has mostly talked with marketing and business development employees, he said, as he seeks to help a Dubai-based crypto exchange fill open roles.&nbsp;



“They all want to stay in Web3, which is surprising,” Wellalage said of the crypto employees he has spoken to. “One of the key themes is that everyone thinks everything happening in the industry is [ultimately] for good.”



In addition to the collapse of FTX and others who are struggling as a result of exposure to the exchange, the broader crypto downturn in recent months has forced many crypto companies to cut headcount.&nbsp;



Valkyrie Investments <a href="https://blockworks.co/news/valkyrie-shrinks-staff-to-16-people-after-latest-cuts/" target="_blank" rel="noreferrer noopener">concluded a 30% cut</a> to its staff that started in June, shrinking the crypto ETF issuer’s headcount to 16 people, CEO Leah Wald told Blockworks Tuesday.&nbsp;



Competing issuers of ETPs, such as 21Shares and CoinShares, have not cut staff and don’t plan to, spokespeople for the firms said. CoinShares looks to maintain its staff levels despite the company’s <a href="https://blockworks.co/news/funds-with-ftx-exposure-have-7-to-12-of-aum-trapped-report" target="_blank" rel="noreferrer noopener">exposure to FTX</a> amounting to roughly $30 million.



Nearly 4,700 people have been laid off in the cryptocurrency sector between Jan. 1 and Nov. 13, according to <a href="https://www.coingecko.com/research/publications/tech-layoffs-by-sectors" target="_blank" rel="noreferrer noopener">a CoinGecko report</a> — representing about 4% of tech layoffs over that span.



Wintermute sends message to crypto talent



“Though layoffs are happening there are a ton of companies still growing right now,” Emily Landon, CEO of <a href="https://www.thecryptorecruiters.io/" target="_blank" rel="noreferrer noopener">The Crypto Recruiters</a> told Blockworks. “The bear market is for building! Companies may not be advertising their jobs, which is why networking is so important.”



Among those looking to boost headcount in the aftermath of FTX’s crash is crypto market maker Wintermute. The company said <a href="https://jobs.lever.co/wintermute-trading/cca667b7-41d2-400c-809c-20750120e5e2" target="_blank" rel="noreferrer noopener">in a blog post</a> this week that it was doubling down on its crypto conviction, in part by looking to hire. Open roles include positions in software development, algorithmic trading and business operations.&nbsp;



The company, which <a href="https://blockworks.co/news/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability" target="_blank" rel="noreferrer noopener">encountered a $160 million breach</a> in its DeFi operations in September, doesn’t have a set number of people it is looking to add, a spokesperson told Blockworks.&nbsp;



“It depends [on] the number of matches we find and we are open in some cases to create roles for exceptional people,” the representative said in an email. “We know many strong and determined people in the industry. Many of them lost their jobs because of insolvencies, layoffs and financial difficulties of former employers.”



Other firms onboarding amid crypto chaos



Georgetown University computer science professor <a href="https://people.cs.georgetown.edu/jthaler/" target="_blank" rel="noreferrer noopener">Justin Thaler</a> joined a16z’s crypto research team.&nbsp;



The venture capital firm <a href="https://blockworks.co/news/andreessen-horowitz-launches-largest-crypto-fund-ever" target="_blank" rel="noreferrer noopener">raised $4.5 billion</a> in May for its fourth crypto fund, bringing its total funds raised to more than $7.6 billion.



Thaler is set to be an in-house resource for portfolio companies and help the team advance the lab’s research and evaluation of zero-knowledge-based projects.



Tim Roughgarden, a research partner at a16z, said in a statement that it has been exciting to see Thaler in recent years move from the theoretical foundations of proof systems to their applications in blockchains and web3.&nbsp;&nbsp;



“This technology is rooted in some of the deepest mathematical results in all of computer science, and Justin’s understanding of it is second to none,” he added.&nbsp;



Crypto trading technology provider Talos added <a href="https://www.linkedin.com/in/joshpeschko/" target="_blank" rel="noreferrer noopener">Josh Peschko</a> as head of compliance and <a href="https://www.linkedin.com/in/alexander-abedine/" target="_blank" rel="noreferrer noopener">Alex Abedine</a> as vice president of regulatory.



The hires came at the same time the company said it was joining the Blockchain Association, a lobbying group focused on improving the public policy environment for crypto networks.&nbsp;



Prior to Talos, Peschko worked at AQR Capital Management, where he was most recently global head of trading and investment compliance. Before that, he was in a risk management monitoring position at JPMorgan.&nbsp;



Abedine was formerly senior product counsel at Coinbase, and was also previously a lead product counsel at Meta Platforms — advising on Instagram&#8217;s NFT marketplace, the expansion of Facebook Payments, and the launch of the Novi digital wallet and Diem digital currency.&nbsp;



Crypto exchange OKX named <a href="https://www.linkedin.com/in/nicole-purin-9a431/" target="_blank" rel="noreferrer noopener">Nicole Purin</a> its deputy general counsel, as the lawyer moves from her traditional finance roots into the world of Web3.



Based in Dubai, Purin joins OKX from Standard Chartered Bank, where she was senior legal counsel of financial markets for Africa and the Middle East.



Purin, who specializes in derivatives, structured finance, capital markets and securitization transactions, has also held roles at BNP Paribas, Mayer Brown and Goldman Sachs.



Moonstake has nabbed the former head of marketing operations at crypto derivatives exchange BitMEX to be its chief marketing officer.



<a href="https://www.linkedin.com/in/pietro-curto/?originalSubdomain=sg" target="_blank" rel="noreferrer noopener">Pietro Curto</a>, who spent about a year at BitMEX and nearly two years before that as a director at Markor Technology, is set to help the staking service provider grow.&nbsp;



Curto called Moonstake&#8217;s mission to create the largest staking pool in Asia, while also lowering the barrier of entry into the crypto market for beginners, is “an ambitious one.”&nbsp;



“I am confident that together, we will realize all of these ambitions and become a trusted and widely recommended platform for crypto users of any experience level,&#8221; he said in a statement.







Updated Nov. 20, 2022 at 5:01 pm ET: A previous version of this article stated that a member of FTX&#8217;s Global Payments team had removed his LinkedIn profile. This was based on a misunderstanding and was incorrect.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

a16z

Employees Burned by FTX Enter a Tightening Market: Latest in Crypto Hiring

<div id="highlights-block_6345d9874d42c" class="highlights">
 <ul>
 <li>ParaSwap was alerted of the vulnerability early Tuesday by security firms</li>
 <li>The vulnerability, in a tool called Profanity, was exploited to drain $160 million from global crypto market maker Wintermute last month</li>
 </ul>
 
</div>



Blockchain security infrastructure company BlockSec confirmed <a href="https://twitter.com/BlockSecTeam/status/1579769525247279104" target="_blank" rel="noreferrer noopener">on Twitter</a> that decentralized exchange aggregator ParaSwap’s deployer address was vulnerable to what’s become known as the Profanity vulnerability.



ParaSwap was first <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368" target="_blank" rel="noreferrer noopener">alerted</a> of the vulnerability early Tuesday morning after Web3 ecosystem security team Supremacy Inc. learned that the deployer address was associated with multiple multi-signature wallets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ Hi <a href="https://twitter.com/paraswap?ref_src=twsrc%5Etfw">@paraswap</a> ,I heard that you want to see this? your deployer address private key may have been compromised (possibly due to Profanity vulnerability) and funds have been stolen on multiple chains.<a href="https://t.co/ijHaTwAj0l">https://t.co/ijHaTwAj0l</a>&mdash; Supremacy Inc. (@Supremacy_CA) <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368?ref_src=twsrc%5Etfw">October 11, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Profanity once was one of the most popular tools used to generate wallet addresses, but the project was abandoned due to <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">fundamental security flaws</a>. 



Most recently, global crypto market maker Wintermute was set back <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">$160 million</a> due to a suspected Profanity bug.



A Supremacy Inc. developer, Zach — who didn’t provide his last name — told Blockworks that Profanity generated addresses are vulnerable to hacks because it uses weak random numbers to generate private keys.



“If these addresses initiate transactions on the chain, exploiters can recover their public keys through transactions and then obtain the private keys by continuously back-propelling collisions on the public keys,” Zach told Blockworks via Telegram on Tuesday.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“There is one and only one solution [to this problem], which is to transfer the assets and change the wallet address immediately,” he said.</blockquote>



After looking into the incident, ParaSwap said that no vulnerabilities were found and denied that Profanity generated its deployer.



Although it is true that Profanity did not generate the deployer, BlockSec co-founder Andy Zhou told Blockworks that the tool that generated ParaSwap’s smart contract was still at risk of Profanity vulnerability.



“They didn’t realize they used a vulnerable tool to generate the address,” Zhou said. “The tool did not have enough randomness which made it possible to crack the private key address.”



Knowledge of the vulnerability has also been able to help BlockSec recover funds. This was true for DeFi protocols BabySwap and TransitSwap, which were both attacked on Oct. 1.



“We were able to retrieve the funds and return them to the protocols,” Zhou said.



After noticing that some attack transactions had been front run by a bot susceptible to Profanity vulnerability, BlockSec developers were able to effectively steal from the thieves.



Despite its popularity as an efficient tool for generating addresses, the developer of Profanity <a href="https://github.com/johguse/profanity" target="_blank" rel="noreferrer noopener">cautioned</a> on Github that wallet security is paramount. “The code will not receive any updates, and I&#8217;ve left it in an uncompilable state,” the developer wrote. “Use something else!”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

hack

The Bug That Took Down Wintermute Is Still at Large

<div id="highlights-block_6332c5ec82bae" class="highlights">
 <ul>
 <li>An external hacker wouldn’t have the knowledge required for contract execution, Edwards alleged</li>
 <li>Wintermute must clarify how the attacker had the necessary signature required, he said</li>
 </ul>
 
</div>



The $160 million hack of market maker Wintermute might have been an inside job, according to one blockchain analyst.



The liquidity provider, among the largest dedicated to crypto market making, was allegedly hacked due to a recently discovered “<a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">vanity address” vulnerability</a> in its DeFi (decentralized finance) operations. CEO Evgeny Gaevoy, who said the firm remained solvent, asked the hacker to get in touch and offered a 10% bounty if the funds were returned.



But a new theory by James Edwards, who goes by the name Librehash on Medium, claims the hack could be pinned down to Wintermute’s own team.



In a <a href="https://medium.com/@librehash_13479/analysis-of-the-wintermute-hack-an-inside-job-736422c08ef1" target="_blank" rel="noreferrer noopener">blog</a> posted on Monday, Edwards said the prevailing theory maintains that an externally owned address (EOA) behind the “compromised” Wintermute wallet was itself compromised because of a vulnerability in a vanity address generator tool. 



But he disputed that theory after analyzing the smart contract and its interactions, concluding that the knowledge required to go through with the hack rules out the possibility that the hacker was random or external.&nbsp;



Edwards noted that the smart contract at issue has “no uploaded, verified code,” which makes it difficult for external parties to confirm the external hacker theory and raises the issue of transparency.&nbsp;



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“The relevant transactions initiated by the EOA make it clear that the hacker was likely an internal member of the Wintermute team,” he wrote.</blockquote>



Further, on conducting an Etherscan analysis, he said the compromised smart contract received two deposits from Kraken and Binance’s hot wallets. “It&#8217;s safe to assume that such a transfer must have been initiated from team-controlled exchange accounts,” he said.



Less than a minute after the compromised Wintermute smart contract received over 13 million in Tether (the total amount of that token), the funds were sent from the wallet manually to a contract supposedly controlled by the hacker.



“We know the team was aware the smart contract had been compromised at this point. So why initiate these two withdrawals directly to the compromised smart contract smack in the middle of the hack?” he said on <a href="https://twitter.com/librehash/status/1574496083614613513" target="_blank" rel="noreferrer noopener">Twitter</a>.



Edwards believes the Wintermute team should provide an explanation of how the attacker would have the necessary signature for contract execution and know which functions to call, since there&#8217;s no contract source code published. He suggested only someone with intimate knowledge would have the capacity to do so.&nbsp;



Edwards is not a professional cybersecurity analyst and his blog on the Wintermute hack appears to be his debut Medium post. But he’s previously put out Twitter threads analyzing possible money laundering on various crypto projects.&nbsp;&nbsp;



The large scale theft was another blemish on the record of the industry as it would hurt the confidence of TradFi (traditional finance) institutions looking to enter the space, according to Marcus Sotiriou, analyst at GlobalBlock. “As Wintermute was one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss,” he said.



Wintermute didn’t return Blockworks’ request for comment by press time.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

data analytics

Was the $160M Wintermute Hack an Inside Job?

<div id="highlights-block_6329e5ceb56f8" class="highlights">
 <ul>
 <li>Bitcoin and ether extend losses following the Ethererum Merge and Wintermute hack</li>
 <li>The S&amp;P 500 and tech-heavy Nasdaq were also veering lower during Tuesday’s trading session, down 1% and 0.6%, respectively</li>
 </ul>
 
</div>



Cryptocurrencies and global equities are due for a volatile week amid ongoing turmoil in the digital asset space and ahead of various central banks’ monetary policy decisions.&nbsp;



Bitcoin briefly rose above $20,000 earlier in the week before falling to under $19,000 Tuesday. Ether lost 1.2%, falling below $1,300 for the first time since mid-July.



“Bitcoin and the crypto market saw a significant bounce Monday, before finding resistance at $19,666 – the 2017 bull market top, a key resistance,” <a href="https://www.linkedin.com/in/marcus-sotiriou-90a2a4192/?originalSubdomain=uk" target="_blank" rel="noreferrer noopener">Marcus Sotiriou</a>, analyst at the publicly listed digital asset broker GlobalBlock, wrote in a note Tuesday. “Investors are very cautious ahead of the Federal Reserve decision tomorrow.”



The S&amp;P 500 and tech-heavy Nasdaq were also veering lower during Tuesday’s trading session, down 1% and 0.6%, respectively.&nbsp;



Ether extended its loss from earlier in the month following the highly anticipated <a href="https://cms.blockworks.co/nft-artists-projects-celebrate-ethereum-merge-with-historic-mints/" target="_blank" rel="noreferrer noopener">Ethereum Merge</a>, which saw the second largest blockchain switch from proof-of-work to proof-of-stake. The currency has lost more than 7% in the past five days since the Merge’s successful completion early Thursday morning.



“We see a classic example of market psychology. Project quotes grew on expectations of a major event. In this case, many traders bought ETH in advance in order to sell on the increased hype by the principle of ‘buy the rumor, sell the fact,’” said Serhii Zhdanov, CEO crypto exchange EXMO. “Naturally, there were fewer buyers after the completion of the Merge.”



Zhdanov is confident that the price can turn around, especially given that a lower transaction cost means the network will be more accessible to users.&nbsp;



“This can increase the adoption of dapps working in the Ethereum ecosystem,” he added.&nbsp;



<h3 class="wp-block-heading">World braces for potentially bearish news</h3>



The volatility from last week shows no signs of slowing, with more market-moving events scheduled for the coming days



On Thursday, the Bank of Japan is slated to release its monetary policy decision, and the Bank of England will reveal its interest rate choice. Initial jobless claims in the US are also expected Thursday. Investors will be watching for indications of labor market strength to gauge the likelihood of a recession.&nbsp;



On the eve of the Fed’s September rate hike decision, futures markets predicted an 82% chance of a 75 basis point rate hike and an 18% chance of a 100 basis point increase, according to <a href="https://www.cmegroup.com/trading/interest-rates/countdown-to-fomc.html" target="_blank" rel="noreferrer noopener">data</a> from CME Group.



Crypto markets were also reeling Tuesday following reports that liquidity provider <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">Wintermute</a>’s DeFi operations had encountered a $160 million breach. The latest incident marks the firm’s second hack this year. In June, 20 million Optimism tokens were stolen by exploiting a <a href="https://cms.blockworks.co/20m-tokens-lost-as-market-maker-wintermute-takes-blame/" target="_blank" rel="noreferrer noopener">failed transaction</a> with Wintermute.



“This is a negative development within the DeFi space, and it will not help with the confidence of TradFi (traditional finance) institutions who are looking to enter the DeFi space,” Sotiriou said. “As Wintermute were one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Bitcoin

Cryptos, Equities Slide on Central Bank Decisions, Merge Aftermath

<div id="highlights-block_63298f8951bb3" class="highlights">
 <ul>
 <li>A bug in vanity address generator Profanity suspected as attack vector, security experts say</li>
 <li>Stablecoins, the vast majority of the funds, have been deposited to Curve Finance, likely to evade blacklisting</li>
 </ul>
 
</div>



Liquidity provider Wintermute, which provides liquidity across most CeFi and DeFi exchanges, has suffered a major setback in a second security-based incident this year.&nbsp;&nbsp;



CEO Evgeny Gaevoy disclosed in a <a href="https://twitter.com/EvgenyGaevoy/status/1572134271011225601" target="_blank" rel="noreferrer noopener">Twitter thread</a> on Tuesday that the platform encountered a $160 million breach in its decentralized finance (DeFi) operations. The firm’s CeFi operations and over-the-counter services weren’t affected, he said.



Gaevoy indicated Wintermute remains solvent, with $320 million in equity left after the hack. Users can expect the platform to face disruptions over the next few days until operations return to normal.&nbsp;



The CEO said the firm is &#8220;open to&#8221; treating the situation as a white hat, referring to hackers that just test vulnerabilities in a system, as compared to malicious hackers. It’s not known whether that is the hacker&#8217;s intent.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We are (still) open to treat this a s a white hat, so if you are the attacker – get in touch&mdash; wishful cynic (@EvgenyGaevoy) <a href="https://twitter.com/EvgenyGaevoy/status/1572134291382960130?ref_src=twsrc%5Etfw">September 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Wintermute is among the largest crypto liquidity providers dedicated to crypto market making for exchanges including Binance and Coinbase.



The hack is already having knock-on effects, such as the <a href="https://twitter.com/bebop_dex/status/1572157679216525319" target="_blank" rel="noreferrer noopener">pausing of trading</a> on Bebob, an upstart DeFi dex using Wintermute&#8217;s market making services.



Tuesday’s incident marks the second time the firm was involved with a hack this year. In June, a hacker stole 20 million Optimism tokens by exploiting a <a href="https://cms.blockworks.co/20m-tokens-lost-as-market-maker-wintermute-takes-blame/" target="_blank" rel="noreferrer noopener">failed transaction</a> with Wintermute.



<h3 class="wp-block-heading">Security experts point to a known bug&nbsp;as Wintermute hack vector</h3>



Mudit Gupta, chief security officer at Polygon, guessed <a href="https://twitter.com/Mudit__Gupta/status/1572150289943363589" target="_blank" rel="noreferrer noopener">in a tweet</a> that the hack was a result of a hot wallet compromise due to the <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">Profanity bug</a> uncovered by 1inch contributors last week. 1inch had warned that wallet addresses generated using the Profanity tool were at risk of compromise.



“If you used Profanity to get a vanity smart contract address, make sure to change the owners of that smart contract,” 1inch staff wrote in a Sept. 15 <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">blog post</a>.



The contributors noted that Profanity’s popularity didn’t mean it wasn’t without defect, and that its vulnerability enabled hackers to “secretly” steal tens of millions of dollars from users’ wallets.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“It’s not a simple task, but at this point it looks like tens of millions of dollars in cryptocurrency could be stolen, if not hundreds of millions,” they said in the post.</blockquote>



The <a href="https://debank.com/profile/0xe74b28c2eae8679e3ccc3a94d5d0de83ccb84705" target="_blank" rel="noreferrer noopener">Ethereum address</a> associated with the Wintermute hack held nearly $13 million in wrapped bitcoin (WBTC) and $9.3 million in ETH, among other tokens including matic, DYDX and FTX tokens as of 6:15 am ET on Tuesday.



Most of the stolen funds — $114 million in USDC and USDT stablecoins — have been moved to Curve Finance flagship “3Crv” liquidity pool. That may make it harder for centralized stablecoin issuers Circle and Tether to freeze the tokens, as they are commingled within the $869 million pool.



A Tether spokesperson told Blockworks that the firm is ready to collaborate in any investigation that law enforcement will initiate to help in the recovery of such funds.



Gaevoy didn’t specify when the hack took place or how it happened. In a <a href="https://twitter.com/EvgenyGaevoy/status/1572329658636537857">later tweet</a>, he offered the hacker a 10% bounty on the funds if returned. Wintermute and Circle didn’t return Blockworks’ request for comment by press time.



This story was updated on Sept. 20 at 11:42 pm ET.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Curve

Wintermute Whacked by $160M Hack Exploiting Known Vulnerability

<div id="highlights-block_62a11c5d87f7a" class="highlights">
 <ul>
 <li>A hacker has acquired 20 million Optimism governance tokens intended for a loan</li>
 <li>The attacker has since transferred or sold about one million tokens — but that’s likely just the start</li>
 </ul>
 
</div>



The airdrop of first-time governance tokens from Ethereum scaling solution Optimism has gone awry in a major way — thanks to a third-party the collective tapped to provide liquidity.



All told, about 20 million Optimism governance tokens (OP) that were loaned to facilitate transactions were lost, with cryptocurrency market maker Wintermute taking responsibility for the lapse.



The loan was initially deployed on Wintermute’s wallets on Optimism, but Wintermute CEO Evgeny Gaevoy said in a <a href="https://gov.optimism.io/t/message-to-optimism-community-from-wintermute/2595" target="_blank" rel="noreferrer noopener">statement</a> that “we made a serious error.” 



Here’s what happened: The wallet address Wintermute used to receive the loan was inaccessible, because it relied on Ethereum layer-1 multi-signature technology that had yet to be deployed to Optimism, which runs as a layer-2. A layer-1 is the foundational function of a given blockchain, while layer-2s are built on top, typically to provide new features or liquidity.



A hacker, meanwhile, took advantage of the technological lapse to transfer the 20 million OP tokens from layer-1 to layer-2, even as Wintermute scrambled to recover the in-limbo funds. The attacker, however, had as of publication only liquidated about a million of the stolen tokens.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">More important is what they knew and when. They knew about this on May 30th. There was a 15 hour gap between the test transaction of 1 <a href="https://twitter.com/search?q=%24OP&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$OP</a> and the following transaction. They didn&#39;t notice something was wrong? They knew 1 million was dumped on 6/5. Did exchanges know about this?&mdash; Benjamin Singer (@BenjaminSinger8) <a href="https://twitter.com/BenjaminSinger8/status/1534657594836627457?ref_src=twsrc%5Etfw">June 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“L1 is confusing enough for most people to navigate, and L2 brings a new set of paradigms over key management and safety, even for experienced crypto users and teams,” Gaevoy said.&nbsp;



“We are not sure why they chose not to liquidate all of it at once,” Gaevoy said. “There is hope that it is a white hat exploit, in which case the remaining funds are potentially recoverable. However we are currently operating under the premise that it is not the case, since we haven’t received any communication from them and our message on the chain was left unanswered.”



The attacker still owns 19 million OP tokens. Wintermute said the company plans to buy back the tokens once the attacker sells, saying the purchase “can potentially create price volatility in the token,” but that the market maker will “make best efforts to smoothen the effect.”



The Optimism Foundation has not chosen to update its network — likely requiring a hard fork — to halt the movement of stolen OP tokens that have not yet been stolen or sold as the foundation believes that “using centralized control to attempt a partial recovery would set a significant precedent.”



Security flaws and the illicit process of attaining cryptoassets have become a common problem for many platforms, and <a href="https://cms.blockworks.co/bipartisan-crypto-bill-hits-congress-with-focus-on-cftc-jurisdiction-taxes/" target="_blank" rel="noreferrer noopener">lawmakers are eager</a> to look for solutions.



It comes down to the hallmark phrase, “Not your keys, not your coins,” Ashton Wolfe, the project lead of Crypto Fight Club, told Blockworks.



“Of course, to protect people&#8217;s assets, governments will think that continuously hammering down on regulations will fix this solution,” Wolfe said. “Unfortunately, this still hasn’t worked, because it is a very slow process, and users resent uploading private documents to these counter-parties in order to use the platform.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

In Latest Crypto Hack, 20M Tokens Lost as Market Maker Wintermute Takes Blame

Jacquelyn Melinek

<div id="highlights-block_6227ad008c97c" class="highlights">
 <ul>
 <li>Avalanche Multiverse’s program and investments will be divided into at least six phases to support new cohorts and projects</li>
 <li>Up to four million AVAX tokens will fund the program</li>
 </ul>
 
</div>



A non-profit fund for the Avalanche blockchain has rolled out an incentive program with millions of dollars earmarked for the proof-of-stake ecosystem.



Up to four million AVAX tokens, or about $290 million at the time of publication, will fund the program, also known as Avalanche Multiverse. 



The initiative will aim to grow its “subnet” functionality, which helps develop application-specific blockchains on Avalanche. Subnets are natively integrated with Avalanche’s broader ecosystem, available in an unlimited supply and allow for custom implementations — or the ability to tack on features from other chains.



Avalanche Multiverse’s program and investments will be divided into at least six phases to support new cohorts and projects but will not be constrained to a specific time period.&nbsp;It&#8217;s a non-profit organization that is run separately from Ava Labs. 



The first subnet to receive an investment from the program is DeFi Kingdoms, an NFT gaming project. It will get up to $15 million in incentives through AVAX tokens, as well as the game’s new Avalanche-native token CRYSTAL and existing token JEWEL.



Ava Labs, a core developer of Avalanche, will also partner with the Aave Companies, GoldenTree Asset Management, Wintermute, Jump Crypto, Valkyrie, Securitize and other organizations to build the subnet. This will allow regulated institutions that participate to leverage its subnets and access institutional DeFi (decentralized finance) after completing know-your-customer (KYC) checks.



“Avalanche Subnets enable us to create an ideal environment for institutions to migrate on-chain and experience the power of DeFi protocols first-hand as users rather than just as investors,” Stani Kulechov, founder and CEO of Aave, said in a statement. “This is a significant leap toward a future where the barriers between traditional and decentralized finance cease to exist.”



In November, Avalanche launched a <a href="https://cms.blockworks.co/avalanche-launches-200m-fund-to-support-ecosystem-growth/" target="_blank" rel="noreferrer noopener">$200 million fund</a> to support ecosystem growth on its blockchain. It also closed a <a href="https://cms.blockworks.co/?s=avalanche#:~:text=Avalanche%20Closes%20%24230M%20Token%20Sale%20Backed%20by%20Three%20Arrows%20Capital%2C%20Polychain" target="_blank" rel="noreferrer noopener">$230 million token sale</a>, backed by Three Arrows Capital and Polychain, a few months prior.&nbsp;



Avalanche’s native token, AVAX, had a price of $75.39 as of 1:30 pm ET on Tuesday, according to CoinMarketCap <a href="https://coinmarketcap.com/currencies/avalanche/" target="_blank" rel="noreferrer noopener">data</a>. The coin’s market capitalization is near $19.9 billion, which ranks the token as the 10th largest cryptocurrency, behind Solana (SOL) and ahead of Binance USD (BUSD), the data show.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>