Ethereum Optimism Thief Returns $16M in Stolen Tokens

The attacker also sent 1 million OP to Vitalik Buterin and retained 2 million tokens as a bounty reward. 

Optimism Attacker Gives Back Loot

The attacker who stole 20 million OP tokens thanks to a Wintermute error has returned the majority of their spoils, Optimism has confirmed. 

Hey folks—in the interest of transparency (?,?), the address has returned a majority of the OP, and @wintermute_t has committed to reimbursing the Optimism Foundation for the remaining 2mm OP, which was kept as a bounty.https://t.co/jtElgPdNPk

— Optimism (✨?_?✨) (@optimismPBC) June 10, 2022

The Ethereum Layer 2 solution posted an update Friday confirming that the attacker behind the incident had returned 17 million of the 20 million OP tokens it stole this week. On Wednesday, Optimism announced that Wintermute had inadvertently lost 20 million OP tokens due to an Ethereum wallet error. 

Optimism had granted the funds to the liquidity provisioning service to help market participants looking to trade the recently-launched OP token on centralized exchanges. However, when Wintermute deployed a Gnosis Safe wallet on Ethereum mainnet without checking that it had been deployed on Optimism, an attacker successfully took control of the wallet on Layer 2 and stole the funds. 

On-chain data shows that the attacker began returning the funds to Optimism’s multi-signature wallet in a series of transactions late Friday afternoon. They also sent 1 million tokens to Ethereum creator Vitalik Buterin Thursday, which Optimism has confirmed “is being recovered.” Interestingly, the attacker also left a message to Buterin in an Ethereum transaction. They wrote: 

“Hello, Vitalik, I believe in you, just want to know your opinion on this. BTW, help to verify the return address and I will return the remaining after you. And hello Wintermute, sorry, I only have 18M and this is what I can return. Stay Optimistic!”

With 18 million tokens sent to Optimism and Buterin, that leaves the attacker with a 2 million OP bounty. At current prices, the returned funds are worth about $16.38 million, while the attacker’s bounty is worth the equivalent of $1.82 million. According to Optimism’s announcement, Wintermute has agreed to reimburse the Layer 2 network for the 2 million OP bounty. 

OP bounced 9.8% today despite a decline across the broader market. Per data from CoinGecko, it’s currently changing hands for about $0.91. 

Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.