Wintermute
From Invertopedia, the encyclopedia of how things fail
Wintermute is a crypto market maker. On September 20, 2022 it said that $160 million had been stolen from its Ethereum vault[2]. Analysts said the vault's admin address, generated with the Profanity vanity-address tool, was likely compromised after the tool's weakness was disclosed[2][3]. Wintermute stayed solvent, with about twice as much equity as was stolen[1].
What happened
| Before Sep 20, 2022 | 1inch publishes a report saying addresses generated with Profanity are not secure, because their private keys can be recovered by brute force.[2] |
|---|---|
| After the warning | Wintermute moves its ether out of the vanity hot wallet but does not remove that address as an admin of its vault.[2][3] |
| Sep 20, 2022 | Wintermute says $160 million has been stolen from its Ethereum vault.[2] |
| Sep 21, 2022 | CEO Evgeny Gaevoy puts the loss at $162.2 million, says the firm is still solvent and is open to treating the attack as a "white hat" event.[1] |
The kill shot
The vault contracts worked as designed. The admin key behind them had a known flaw, and Wintermute did not take that address's admin rights away when the flaw was published.
Mudit Gupta said that the vault only allows admins to make these transfers, so the contracts worked as expected but the admin address was likely compromised[2]. Gaevoy confirmed on Twitter that the firm used a vanity address[2].
The inversion
When a tool you used to make keys is shown to be breakable, rotate every key it made, including the ones that only hold permissions.
References
- ^ “$162M Stolen from Digital Asset Trader Wintermute”. SOCRadar, September 21, 2022. The CEO's $162.2 million figure, the firm's business, its solvency and the white hat offer.
- ^ “Experts blame a 'vanity address' bug for Wintermute's $160 million hack”. The Block, September 20, 2022. The $160 million theft, the vanity admin address, the 1inch Profanity warning, the ether moved but admin left, Gupta's analysis and Gaevoy's gas-efficiency reason.
- ^ “Explained: The Wintermute Hack (September 2022)”. Halborn, September 26, 2022. The Profanity seed weakness and that Wintermute removed ether from the hot wallet but not its admin role.