• Wintermute discovered that it could not access the tokens due to technical oversight and an attacker took control of the contract on L2, retrieving the 20 million OP tokens. 
  • Optimism price posted double-digit losses since the hack. 
  • The attackers have cashed out 1 million OP tokens through Tornado Cash; it is not a white hat exploit. 

Optimism price took a hit after a hacker stole 20 million of its tokens whilst in transit to market maker Wintermute. The attack was thought to have resulted from a technical oversight by the market maker. Optimism, which is transparent in its updates, informed the community that  it had now reimbursed Wintermute with an additional 20 million replacement tokens post the attack. 

Also read: Everything you need to know about Ethereum's Merge testnet upgrade

Optimism tokens lost to attack on market maker Wintermute

Optimism, a low-cost lightning-fast Ethereum layer-2 blockchain, informed the community of the loss of 20 million OP tokens from a malicious attack. Optimism engaged market maker Wintermute to provide liquidity for its tokens, sending them 20 million OP. 

Due to a technical oversight, Wintermute discovered they could not gain control of the OP tokens since the smart contract was still on L1 and had not been updated to be deployed on Optimism. This technical oversight left Wintermute vulnerable to a hack, and a bad actor took charge of the situation, grabbing 20 million OP tokens on the L2 for themself. 

One million out of the 20 was moved to Tornado Cash, enabling users to send and receive funds from a mixed source. The attacker converted OP to Ethereum and sent it to an unknown address via Tornado Cash. 

Another 1 million has been withdrawn over the past hour, and the wallet’s balance is now 18 million OP tokens. 

Attacker's wallet with a balance of 18 million OP tokens

Attacker’s wallet with a balance of 18 million OP tokens

As soon as Wintermute became aware of the attack, it began a recovery operation with the goal of deploying the L1 multisig contract to the same address on L2. The remedy arrived too late, and the attacker had already taken control of the 20 million OP tokens, cashing out 2 million in the process. 

Optimism’s transparency update arrived late

While the team at Wintermute informed Optimism Foundation of the attack on May 30, 2022, the layer-2 solution chose to wait to publish a transparency update on June 9, 2022. 

The initial deployment of 20 million tokens occurred two weeks ago. After learning about the attack, Optimism provided another 20 million tokens to Wintermute while the market maker worked to retrieve the lost tokens. 

Wintermute was under the impression that the funds were recoverable only by their team; however, this assumption was proven false when the attacker started selling their OP token holdings, by converting them to Ethereum and then transferring them to unknown addresses on Tornado Cash. 

Wintermute consulted with the Gnosis Safe team, asking them for their assessment and help in attempting to recover the lost OP tokens. 

Kelvin Fichter, a researcher and developer, shared detailed insights into the incident in a Twitter thread, revealing key details of the attack and how it could have been prevented

How the attacker stole 20 million OP tokens

In less than 24 hours of Wintermute notifying Safe and Optimism, wallet 0x8BcFe4f1358E50A1db10025D731C8b3b17f04DBB was funded via tornado cash transfer 134. 

The attacker replayed the Gnosis Safe MasterCopy 1.1.1 deployment from the Ethereum mainnet and used the previously deployed contract 

0xE7145dd6287AE53326347f3A6694fCf2954bcD8A to deploy vaults per batches of 162. The hacker then proceeded with selling 1 million OP tokens for ETH and withdrew back to L1 via Synapse and Hop bridges to then use tornado cash on the mainnet.

What Wintermute is doing

According to their confessional transparency update, the initial error in which Wintermute was unable to access OP tokens was 100% their fault. Wintermute, a market maker with a global reach, is now intent on buying OP every time the attacker sells to make the protocol whole eventually. 

After the attacker’s 1 million OP tokens sale, Wintermute purchased an equivalent amount, and the market maker believes this is not a white hat exploit. Wintermute acknowledges that the attacker’s sale of OP tokens can potentially create price volatility in OP tokens. 

Since the announcement, OP token price has plummeted by 14%. 

Wintermute left a message for the attacker, however there is no update on any response. 

Crypto Twitter criticizes Optimism and Wintermute

Dovey Wan, advisor to Coindesk, criticized Wintermute for making an amateur mistake. Deploying the multisig contract on the wrong chain is an “amateur mistake,” Wan told Twitter followers. 

Dovey believes the Optimism team should have postponed the airdrop for a better consequence and pushed out the transparency report to later. 

Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.

If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.

FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.

The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.

Cryptos feed Join Telegram

Recommended content

Recommended Content

Editors’ Picks

Shiba Inu price edges close to a 60% breakout as bears watch in disbelief

Shiba Inu price edges close to a 60% breakout as bears watch in disbelief

Shiba Inu price has managed to stay above the POC at $0.0000118, indicating support from bulls. A continuation of this momentum could trigger a 60% rally to $0.0000200. A daily candlestick close below the $0.0000106 support level will invalidate the bullish thesis for SHIB.

More Shiba Inu news

XRP price attempts a 15% rally on Ripple’s interest in buying Celsius' assets

XRP price attempts a 15% rally on Ripple’s interest in buying Celsius' assets

XRP price shows a willingness to move above a significant resistance level, which it has attempted to do so for the past three months and failed each time. While this attempt is like any other and could fail, especially if the momentum is lacking. 

More Ripple news

Avalanche price makes a turn for the better

Avalanche price makes a turn for the better

Avalanche price shows classic ramping pattern accompanied with price ascension. AVAX price has breached the oversold level on the Relative Strength Index. If the technicals are correct, a breach of the $50 barrier could happen rapidly.

More Avalanche news

Binance Coin Price Prediction: Whales take naps at the shore

Binance Coin Price Prediction: Whales take naps at the shore

Binance coin shows reasons to believe in a market bottom. Traders should keep the smart contract giant on their watchlists throughout the summer. Binance coin price is beginning to show evidence of strength.

More Bitcoin news

Bitcoin: If bulls lose control here, BTC could revisit $21,000

Bitcoin: If bulls lose control here, BTC could revisit $21,000

Bitcoin price shows an interesting setup that could reveal its next move. On closer inspection,  its technicals support a bearish outlook for the leading crypto.  

Read full analysis