Crypto Sleuth: This Is Why the Wintermute Exploit Was an Inside Job

Crypto sleuth James Edwards, aka Librehash, has offered his take on the attack vector used to rob London-based crypto firm, Wintermute on Sep. 20, 2022, alleging that the attack was an inside job.

Edwards offers a theory that the knowledge to perform this attack required intimate knowledge of Wintermute’s systems, and was not simply the result of an externally owned address (EOA) calling a Wintermute smart contract compromised by Profanity, a service Wintermute used to help lower transaction costs.

Following the attack, the prevailing theory was that it originated from Profanity. Wintermute blacklisted its Profanity accounts after DEX aggregator 1inch network had highlighted a security flaw in Profanity’s code.

Through human error, the London-based company had forgotten to blacklist one account, that CEO Evgeny Gaevoy suspected allowed the hacker to make off with $120 million in so-called stablecoins, $20 million worth of bitcoin and Ether, and $20 million worth of other altcoins.

Edwards specifically points out that functions within an intermediary smart contract (address 1111111254fb6c44bac0bed2854e76f90643097d) are responsible for coordinating the funds’ transfer between the Wintermute smart contract (address 0x0000000ae) and the alleged hacker (address 0x0248) point to the Wintermute team as the owner of the externally owned address (EOA).

Specifically, the function within the intermediary contract reveals that funds cannot be moved without the caller validating their security clearance.

Furthermore, the Wintermute smart contract revealed two deposits from exchanges Kraken and Binance before the funds were moved to the hacker’s smart contract. Edwards believes that deposits came from exchange accounts controlled by the Wintermute team. Otherwise, at least two questions need answering: a) Would the Wintermute team have been able to withdraw funds from both exchanges into their smart contract in under two minutes after the exploit began? b)If the answer to the first question is no, how did the hacker know of Wintermute’s two exchange accounts?

Wintermute likely to pursue legal action

Following the hack, Wintermute reached out to the hacker, offering them a 10% bounty if all stolen funds were returned within 24 hours. Gaevoy also announced an investigation involving internal and external service providers.

At the time of writing, the hacker had not responded to the bounty offer, meaning that Wintermute will likely pursue legal action.

The company has made no official announcement on its intended course of action.

The Wintermute hack was the fifth-largest DeFi hack of 2022.