Wintermute Makes “Optimistic” Assumption, Loses 20M Tokens

The crypto market-making firm Wintermute has lost roughly $17.6 million worth of OP tokens belonging to the Optimism Foundation due to a severe wallet management error.

Hacker Steals 20M OP Tokens 

Wintermute’s optimistic assumption has led to a $17.6 million loss.

The crypto market maker Wintermute has made a severe wallet management error leading to the loss of 20 million OP tokens given to the firm to help provide liquidity on centralized exchanges. While the loss occurred four days ago, on June 5, it was only publicized by Optimism on Wednesday. 

Hey folks–in the interest of transparency, we’d like to share some details about an ongoing situation:https://t.co/915vIgRIJG

Summary below ??

— Optimism (✨?_?✨) (@optimismPBC) June 8, 2022

“Hey folks—in the interest of transparency, we’d like to share some details about an ongoing situation,” the foundation behind the Ethereum Layer 2 scaling solution wrote yesterday on Twitter. It explained that, two weeks ago, it had granted 20 million OP tokens to Wintermute for liquidity provisioning services to ensure a smoother experience for users looking to purchase the tokens on centralized exchanges.

Despite doing two test transactions before sending the bulk of the tokens, Wintermute quickly discovered that they had mistakenly provided a multi-signature Ethereum address that had not yet been deployed on the Optimism network, meaning that they could not access the funds on the Layer 2 despite confirming they had been successfully deposited. The mistake Wintermute made was optimistically assuming that control over the multi-signature wallet on the Ethereum mainnet would also mean control over funds received to the same wallet on other EVM compatible chains, as is typically the case with ordinary wallets. However, as the market maker explained in a late Wednesday message to the Optimism community, this wasn’t the case:

“We had a Gnosis safe deployed on mainnet for a while and due to an internal mistake, we’ve communicated the very same wallet as the receiving address. As some of you may know, this is not a smart thing to do—having control over a mainnet Safe doesn’t guarantee control on other EVM compatible chains (unlike ordinary wallets).”

After consulting with the Optimism and Gnosis Safe teams, Wintermute realized that the funds could be retrieved but again made the wrong assumption that they could only be retrieved by it. “Wintermute made the assessment that the funds were potentially retrievable, and that nobody other than Wintermute could recover those funds,” it wrote. “However, the assumption that the funds can only be recoverable by Wintermute proved to be false.”

Before Wintermute and Gnosis Safe could execute the recovery operation scheduled for June 7, a hacker deployed the multi-signature Gnosis Safe wallet (a smart contract account) on the Layer 2 network and took control of the 20 million OP tokens. Based on on-chain data, the hacker has so far sold one million tokens and transferred one million more to Ethereum founder Vitalik Buterin.

Wintermute has since taken full responsibility for the incident and committed to buying OP tokens every time the attacker sells in order to eventually make the protocol whole again. It also noted that it had received another 20 million in OP tokens, secured by $50 million in USDC collateral, to provide liquidity provisioning services. In a last-ditch effort to recover the funds, Wintermute sent the following message to the attacker:

“You have one week to consider being a whitehat. In case the above doesn’t happen, we are 100% committed to returning all the funds, tracking the person(s) responsible for the exploit, fully doxxing them and delivering them to the corresponding juridical system.”

Optimism’s OP governance token, airdropped to previous network participants on May 30, plummeted from around $1 to roughly $0.72 following the news. It currently trades for around $0.88, down 12% on the day.

Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.