Wintermute

On September 20, 2022, market maker Wintermute disclosed that an attacker had drained roughly $160 million in stablecoins and other tokens from one of its Ethereum-based DeFi vaults. Founder Evgeny Gaevoy said the cause was a private-key compromise rather than a flaw in the smart contract itself (The Hacker News).

How the attack worked

The vault's admin address — the wallet authorized to move funds — had been generated with Profanity, a popular open-source tool for producing "vanity" addresses with a chosen prefix (Wintermute used addresses starting with 0x000000 to save gas on repetitive transactions). A week before the hack, researchers at 1inch had disclosed that Profanity's seed generation was flawed: instead of drawing from the full private-key space, it used a much smaller, GPU-predictable seed, so anyone with enough compute could reconstruct the private key behind any address the tool had ever produced (Forbes). This is more precisely a broken-entropy, precomputation attack than a literal exhaustive search of a 256-bit keyspace — but the practical result matches the category in our database: the key was computed, not phished or leaked.

Wintermute had ten wallets generated with Profanity and says it moved to retire all of them once the flaw became public. One was missed "due to a human error," according to Gaevoy — and that one happened to be the vault's admin wallet. The attacker computed its private key, called the vault's admin functions directly, and withdrew the funds. Polygon's security lead Mudit Gupta noted the contract itself behaved exactly as designed: the exploit lived entirely in the compromised credential, not the code (The Block).

What happened after

Wintermute said the breach was confined to its DeFi trading operations; its centralized-exchange and OTC desks were unaffected. Gaevoy stated the firm remained solvent, with equity well above the size of the loss, and publicly offered the attacker a 10% "white hat" bounty (about $16 million) to return the rest, warning that the window to negotiate was closing. The attacker never engaged and instead moved the funds onward through Curve and Tornado Cash. No funds were ever recovered, and no arrests have been reported. Wintermute continued operating without interruption, including meeting its existing debt obligations.

What this means

• Vanity-address generators without an audited, high-entropy random source are a structural liability for any wallet holding real value — the risk stays invisible until someone reverse-engineers the generator, at which point every address it ever produced is retroactively compromised.
• A privileged "admin" wallet on a smart contract carries the same blast radius as a wallet holding funds directly; access-control design and incident response both have to treat it that way.
• Partial remediation after a public vulnerability disclosure is close to no remediation: Wintermute knew about the Profanity flaw and rotated nine of ten wallets, but the tenth was enough. Once a key-generation tool is shown to be broken, every address it ever produced needs to be treated as compromised and moved — not "blacklisted."
• Segmenting DeFi, CeFi and OTC operations into separate custody paths confined the damage to one silo and let the firm absorb a nine-figure loss without insolvency — a case for operational compartmentalization independent of any single contract's security.