The Wintermute Hack Explained: $160M

Video transcript

Wintermute's DeFi vault was drained in September 2022. The likely cause was a hot wallet key, emptied of ether but still a vault admin.

CEO Evgeny Gaevoy put the loss at about 160 million dollars. He said CeFi and OTC operations were not affected.

Analysts did not blame a contract bug. Only admins could move vault funds, and Wintermute's hot wallet was one.

Profanity, a vanity address tool, seeded keys from a 32-bit value, 1inch disclosed. Pick one of about 4 billion seeds, expand to 2 million keys, increment to the wanted address. Those steps can run backward.

Rekt reported Wintermute emptied that address of ether but forgot to remove it as a vault admin. A key needs no balance to be dangerous, only a vault that trusts it.

A GitHub issue flagged Profanity's seeding in January 2022. Disclosure came on September 15, and the vault was drained five days later.

Ask how each bot key was generated, which contracts trust it as admin, what it can call, whether retiring it revokes every role, and whether advisories are checked against your keys.

Guardian's Offchain Automation Pentest covers bots, keepers, relayers and threshold signers. It tests their privileges, their schedulers and jobs, and their failure behavior.

Read the full article, or talk to Guardian at guardian.security to map what your bot keys can do.

Wintermute is a crypto market maker. On September 20, 2022, it lost what CEO Evgeny Gaevoy called "about $160M" from its DeFi operations.

Analysts did not blame a contract bug. "The contracts worked as expected but the admin address itself was likely compromised," Polygon's Mudit Gupta wrote, as The Block reported.

The likely weakness had been explained publicly five days earlier. Here is what happened, how it worked and what it shows about automated keys.

What Happened

Wintermute held funds in a DeFi vault contract, and only admins could move them out.

"The vault only allows admins to do these transfers and Wintermute's hot wallet is an admin, as expected," Gupta explained.

Both the hot wallet and the vault "appear to have vanity addresses, with multiple leading zeros," Rekt wrote. It named a weakness in the Profanity tool as the likely cause.

Gaevoy later said the address style was for "gas optimization, not vanity," The Block reported.

The hot wallet's private key "was likely compromised and used to drain the vault," per Rekt. Gaevoy announced the loss about three hours after the theft:

"We've been hacked for about $160M in our defi operations. Cefi and OTC operations are not affected."

In an update that day, he blamed an "internal (human) error." The attack was most likely a "Profanity-type exploit," he added, according to The Block.

How the Attack Worked

Profanity's weak seed

Profanity was a tool for generating Ethereum vanity addresses. It searched for keys whose addresses match a wanted pattern, such as leading zeros.

On September 15, 2022, 1inch disclosed how it worked. Profanity "used a random 32-bit vector to seed 256-bit private keys."

That left about 4 billion possible seeds. 1inch described the generation in three steps:

1. Pick 1 of about 4 billion seed private keys at random.
2. Expand it deterministically to 2 million private keys.
3. Increment them until one reaches the wanted address.

The steps run backward. Recover the public key from any transaction the address signed, expand it, and decrement until you reach the seed, 1inch explained.

Its proof of concept could recover keys "at almost the same time that was required to generate that vanity address."

1inch's warning: "Your money is NOT SAFU if your wallet address was generated with the Profanity tool." For vanity contracts, it advised changing the owners.

The weakness was not new. A GitHub issue in January 2022 flagged that Profanity's random generator was initialized from a 32-bit value. On September 15, its author archived the project.

An emptied key that kept its power

Wintermute did react. Around the time of the disclosure, it "removed all ether from this admin address," Rekt wrote.

"However, they forgot to remove the address as an admin from their vault."

The Block's report of Gaevoy's update tells the same story. While "retiring" the old key, Wintermute moved all its ETH but did not remove the address's ability to sign.

An admin key does not need a balance to be dangerous. It only needs the vault to keep trusting it.

Timeline and Impact

Gaevoy's figure was about $160M. At the time of writing, Rekt valued the attacker's address at about $162.3M.

Rekt counted $118.4M in stablecoins, most of it deposited into Curve's 3pool. The rest included 671 WBTC (about $13M) and 6,928 ETH ($9.4M).

Gaevoy said CeFi and OTC operations were not affected. "We are solvent with twice over that amount in equity left," he wrote.

He also said Wintermute would not lay off employees or stop its DeFi operations, The Block reported.

Other Profanity addresses were hit too. After the disclosure, one address drained $3.3M from various wallets over the following days, Rekt reported.

What It Shows

• Key generation is part of key security. A 32-bit seed left about 4 billion starting points, per 1inch.
• Retiring a key means revoking it. Moving the ether did not change what the vault let it do.
• Disclosure starts a clock. 1inch's write-up came five days before the hack.

Gaevoy also acknowledged the limits of high-frequency onchain trading: no safeguards "such as 2FA protected key generation or the ability to use multisigs," The Block reported.

That puts the weight on the limits around each hot key. Teams running bots or market-making keys can ask:

• How was each automated key generated, and with what tool?
• Which contracts list it as an admin, owner or signer?
• What can it call, and what caps a single run?
• When a key is retired, is every role revoked and checked onchain?
• Is each new advisory matched against the key inventory?

Our report on time to exploit tracks how fast disclosures turn into attacks. Our guides to key ceremonies and hot wallet monitoring cover generation and detection.

How Guardian Tests Bot Keys

Guardian's Offchain Automation Pentest covers keepers, relayers, bots and threshold signers, which "use real privileges unattended."

Its areas include:

• Bot and keeper privileges: what each automated key can call, whether the contract limits it, and the ceiling on one run.
• Schedulers and jobs: what triggers a run, and what a skipped or duplicate one does onchain.
• Failure behavior: whether a stuck or spammed job halts safely, and how an operator steps in mid-incident.

The review starts by establishing what the automation must guarantee. Source code access is required.

For the people and roles around keys, Guardian's OpSec Audit covers "keys, signers, privileged roles and the people around them, mapped and tested."

Frequently Asked Questions

How much was stolen in the Wintermute hack?

About $160M from Wintermute's DeFi operations on September 20, 2022, according to CEO Evgeny Gaevoy. Rekt counted $118.4M in stablecoins plus WBTC, ETH and other tokens. Gaevoy said CeFi and OTC operations were not affected.

What is the Profanity vulnerability?

Profanity, an Ethereum vanity address tool, seeded 256-bit private keys from a random 32-bit value, 1inch disclosed on September 15, 2022. That left about 4 billion seeds, and 1inch showed keys could be recovered from Profanity addresses.

Why could the attacker drain the vault?

The vault let admins move funds, and Wintermute's hot wallet was an admin. Wintermute had removed the ether from that address, but Rekt reported it forgot to remove the address as an admin of the vault.

Was Wintermute insolvent after the hack?

Gaevoy said no: Wintermute was solvent "with twice over that amount in equity left." The Block reported he said the firm would not lay off employees or stop its DeFi operations.

Sources

• Rekt: Wintermute, REKT 2 (September 20, 2022)
• The Block: Experts blame a 'vanity address' bug for Wintermute's $160 million hack (September 20, 2022)
• The Block: Wintermute CEO Gaevoy updates on hack (September 20, 2022)
• 1inch: A vulnerability disclosed in Profanity, an Ethereum vanity address tool (September 15, 2022)
• GitHub, johguse/profanity: Issue #61, Private key safety (January 17, 2022)
• GitHub, johguse/profanity: README and archive notice (September 15, 2022)
• Guardian: Offchain Automation Pentest