See More

Crypto Sleuth: This Is Why the Wintermute Exploit Was an Inside Job

2 mins
Updated by Ryan Boltman
Join our Trading Community on Telegram

In Brief

  • According to a crypto sleuth Librehash, the Wintermute hack required a level of security clearance only available to insiders.
  • He highlights deposits from Kraken and Binance also as red flags pointing to an insider attack.
  • The hacker did not respond to Wintermute's bounty offer.
  • promo

Crypto sleuth James Edwards, aka Librehash, has offered his take on the attack vector used to rob London-based crypto firm, Wintermute on Sep. 20, 2022, alleging that the attack was an inside job.

Edwards offers a theory that the knowledge to perform this attack required intimate knowledge of Wintermute’s systems, and was not simply the result of an externally owned address (EOA) calling a Wintermute smart contract compromised by Profanity, a service Wintermute used to help lower transaction costs.

Following the attack, the prevailing theory was that it originated from Profanity. Wintermute blacklisted its Profanity accounts after DEX aggregator 1inch network had highlighted a security flaw in Profanity’s code.

Through human error, the London-based company had forgotten to blacklist one account, that CEO Evgeny Gaevoy suspected allowed the hacker to make off with $120 million in so-called stablecoins, $20 million worth of bitcoin and Ether, and $20 million worth of other altcoins.

Intermediary smart contract reveals hacker needed security clearance

Edwards specifically points out that functions within an intermediary smart contract (address 1111111254fb6c44bac0bed2854e76f90643097d) are responsible for coordinating the funds’ transfer between the Wintermute smart contract (address 0x0000000ae) and the alleged hacker (address 0x0248) point to the Wintermute team as the owner of the externally owned address (EOA).

Specifically, the function within the intermediary contract reveals that funds cannot be moved without the caller validating their security clearance.

Furthermore, the Wintermute smart contract revealed two deposits from exchanges Kraken and Binance before the funds were moved to the hacker’s smart contract. Edwards believes that deposits came from exchange accounts controlled by the Wintermute team. Otherwise, at least two questions need answering: a) Would the Wintermute team have been able to withdraw funds from both exchanges into their smart contract in under two minutes after the exploit began? b)If the answer to the first question is no, how did the hacker know of Wintermute’s two exchange accounts?

Following the hack, Wintermute reached out to the hacker, offering them a 10% bounty if all stolen funds were returned within 24 hours. Gaevoy also announced an investigation involving internal and external service providers.

At the time of writing, the hacker had not responded to the bounty offer, meaning that Wintermute will likely pursue legal action.

The company has made no official announcement on its intended course of action.

The Wintermute hack was the fifth-largest DeFi hack of 2022.

Top crypto projects in the US | July 2024
Harambe AI Harambe AI Explore
Uphold Uphold Explore
Exodus Exodus Explore
Coinbase Coinbase Explore
Chain GPT Chain GPT Explore
Top crypto projects in the US | July 2024
Harambe AI Harambe AI Explore
Uphold Uphold Explore
Exodus Exodus Explore
Coinbase Coinbase Explore
Chain GPT Chain GPT Explore
Top crypto projects in the US | July 2024

Trusted

Disclaimer

In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and ConditionsPrivacy Policy, and Disclaimers have been updated.

David-Thomas.jpg
David Thomas
David Thomas graduated from the University of Kwa-Zulu Natal in Durban, South Africa, with an Honors degree in electronic engineering. He worked as an engineer for eight years, developing software for industrial processes at South African automation specialist Autotronix (Pty) Ltd., mining control systems for AngloGold Ashanti, and consumer products at Inhep Digital Security, a domestic security company wholly owned by Swedish conglomerate Assa Abloy. He has experience writing software in C,...
READ FULL BIO
Sponsored
Sponsored