Explained: The Wintermute Hack (September 2022)

In late September 2022, Wintermute, a leading algorithmic market maker (AMM), was hacked for $160M. This is Wintermute’s second major hack of the year. This time around, one of their hot wallets was compromised, most likely due to its security weaknesses as a Profanity vanity address. 

Profanity has already been an ongoing part of the newscycle this month, with this wallet taking advantage of a weakness in the wallet’s key generation process to access and drain $3.3M+ in tokens from various users’ wallets. 

What happened in the Wintermute Hack?

The Profanity tool is a vanity wallet address generator. Vanity wallets are custom-made crypto addresses that contain a string of characters that is easy to remember and identify. For example, a person might create a vanity address that contains their initials. Vanity wallet address generators like Profanity allow for the creation of these personalized addresses.

The Wintermute attack was enabled by a defect in Profanity’s algorithm. In a departure from the usual smart contract exploits, this defect allowed an attacker to directly target compromised private keys of Wintermute users.

We addressed the Profanity weakness in a previous post but here is a short explanation: for the most secure cryptographic practices, a cryptographic pseudorandom number generator (CPRNG) seeded with a random value is used to create random values, such as private keys. Profanity, however, seeded its CPRNG with a 32-bit number. Thus, an attacker with significant compute resources was able to brute-force their way through Profanity address’ possible seed values and recreate the private keys. In Wintermute’s case, both their DeFi vault contract, as well as their hot wallet are likely to be vanity addresses.

When the Profanity Hack came to public awareness, Wintermute did take steps to remove all ether from the hot wallet, however they failed to remove the address as an admin from their vault. What likely happened is that the hot wallet’s private key was compromised and used to drain the vault. $118.4M funds were stolen, with the majority being stablecoins, along with 671 WBTC (~$13M) and 6,928 ETH ($9.4M) and a variety of other tokens.

Lessons Learned From the Attack

Thankfully, after the initial Profanity vulnerability was discovered, all affected binaries in the Profanity github repo were removed by its creator in order to prevent further unsafe use of the tool. But what about the next tool or software update? To learn more about securely creating and managing your blockchain account private keys, reach out to our Web3 security experts at halborn@protonmail.com.