One more hack – The news has just fallen, Wintermute, the market making platform has been the target of a major hack. Several tens of millions of dollars were stolen.
Update on September 20 at 2:30 p.m.: new elements concerning the cause of the hack.
$160 million stolen from Wintermute
a few hours ago, Evgeny Gaevoy the CEO of wintermute took to Twitter to announce that the platform had been the target of a hack.
Thus, he revealed that 160 million dollars had been stolen on operations Challenge of the company. Indeed, CeFi and OTC operations (Over The Counter) would not have been affected by the attack.
He nevertheless wishes to reassure users and investors, by declaring that the platform remains solvent. Indeed, he has more than twice that amount left in equity.
In additionEvgeny Gaevoy wished to reassure the rest of the community vis-à-vis a potential dump massive (collapse) of stolen assets:
“Of the 90 assets that were hacked, only two were for notional amounts greater than $1 million. So there shouldn’t be any major collapse. »
Finally, Gaevoy announced that Wintermute was ready to treat this attack as a white hat maneuver. This leaves open the door to negotiations with the attacker.
This major hack could take 7th place in the ranking of the worst hacks maintained by the Rekt media.
The hacker guards against censorship
Soon after carrying out his attack, the Wintermute hacker deposited all stolen stablecoins (i.e. $118 million) in Curve’s 3CRV pool.
As stated 0xtuba on Twitter, this maneuver was probably carried out to prevent Circle or Tether from freezing the stolen funds.
This colossal deposit makes the hacker the third largest holder of the 3CRV pool.
Profanity: the wallet generator behind the hack
Obviously, following this attack several crypto-investigators went in search of the causes of this hack. Quickly, they identified the Profanity rift trail.
Thereby, 1inch recently brought to light a flaw in the Profanity tool. In practice, Profanity is a tool that allows you to generate customizable Ethereum addresses. These personalized addresses are commonly called vanity addresses.
Therefore, the attacker would have reportedly succeeded in regenerating the private key from one of Wintermute’s hot wallets. Then, once the private key in his possession, he could have the cryptocurrencies stored on the wallet.
Now, the amounts stolen through the loophole in the Profanity tool amount to over $170 million. At this rate, this could become one, if not the, Biggest flaw I’ve known Ethereum.
At the same time, 1inch only revealed the flaw present in Profanity a few days ago. The objective was to warn wallets potentially at risk. A warning that may have put the Wintermute hacker in the ear.
Another one bites the dust.. Another giant of the crypto ecosystem bites the dust. Avoid leverage for a while and you’ll be fine. Register without delay on the FTX reference crypto exchange platform. In addition, you benefit from returns of up to 8% on all your cryptocurrencies (commercial link, see conditions on official website).