From: zerohedge
Image source: CryptoSlate
Wintermute, a cryptocurrency market maker and liquidity provider, suffered a security compromise in which attackers made off with around $160 million in digital assets on Sept. 20.
The vulnerability responsible appears to be a known bug in a tool used to generate crypto wallet addresses.
DeFi exploit costs crypto market maker $160 million
Cryptocurrency’s decentralized finance — aka DeFi — sector is no stranger to software exploits leading to massive losses. The latest occurred in the early hours of Sept. 20, against the market maker and liquidity provider Wintermute. It is the second incident to impact the firm this year.
DeFi refers to a collection of financial applications deployed on blockchains like Ethereum using smart contracts. Unlike traditional financial platforms, DeFi apps are designed to operate without a central entity and do not require permission to use.
This makes them susceptible to software exploits, which occur when an attacker finds a vulnerability in an app’s code. Last year, DeFi exploits were responsible for losses totaling over $1.3 billion.
In a Twitter thread detailing the incident, Wintermute CEO, Evgeny Gaevony, stated that the attacker took around $160 million in 90 crypto assets. He also confirmed that the exploit only impacted Wintermute’s DeFi activities and that centralized and over-the-counter operations are unaffected.
Adding that the firm remains solvent “with twice over that amount in equity left,” the CEO stated that the funds of all parties with agreements with the company are safe and that normal service will continue in a few days.
Commenting on the exploit, Andrei Grachev, Managing Partner at fellow crypto market-making firm DWF Labs, stated:
“DeFi markets are still a technological Wild West, with hackers continuing to attack lending platforms and LP protocols while targeting big players in the market. Smaller retail investors could also be affected if larger participants are overtly compromised.”
Monica Oravcova, Chief Operations Officier at on-chain cybersecurity firm Naoris Protocol, added:
“There is a huge opportunity for a Web3 based cybersecurity technology like Naoris Protocol that can provide the missing framework for comprehensive Web3 security, that can detect hacks in seconds not days and months.”
Suspected wallet vulnerability dents Wintermute’s DeFi operations
The Wintermute exploit appears to be related to the wallet at which the company stored most of its DeFi funds. The wallet in question used what is popularly known as a “vanity address.”
Wallet addresses are long strings of letters and numbers that are derived from a wallet’s private key, and are used to receive funds. Meanwhile, private keys are similar strings that act like a wallet’s master password.
Anyone with a private key has complete control of the wallet and any funds in it. When created correctly, addresses are generated using advanced cryptography that essentially makes it impossible to work out a private key from the address.
Typically, a wallet address appears to be entirely random, but vanity addresses contain some characters that are not random. This might be a protocol name or some other human-recognizable character sequence somewhere in the address. One of the most popular tools for creating vanity addresses is called Profanity.
A known vulnerability concerning Wintermute’s “vanity address” appears responsible for the exploit. Source: Etherscan
Blockchain researchers at the decentralized exchange protocol 1inch detailed a Profanity vulnerability in a blog post on Sept. 15. They then developed code that demonstrated how it was possible to recover private keys from vanity addresses generated using Profanity. In concluding the post, they wrote:
“It looks like tens of millions of dollars in cryptocurrency could be stolen, if not hundreds of millions.”
Around 16 hours after the incident, Gaevoy tweeted in a second thread:
“The attack was likely linked to the Profanity-type exploit of our DeFi trading wallet.”
The CEO stated that the address was used for “gas optimization” — meaning the many blockchain transactions the company engages in would cost less in transaction fees. He continued, writing that the company was in the process of retiring the key after learning of the Profanity vulnerability.
However, “an internal (human) error” lead to the wallet — which was programmed to facilitate Wintermute’s automated DeFi trading — becoming temporarily inaccessible. This created a longer window in which the wallet could fall victim to the known exploit.
Commenting on the incident Ajay Dhingra, head of research and analytics at smart exchange Unizen, stated:
“The bug was disclosed by the 1inch team just days ago, highlighting the importance of approaching this problem collectively to weed out similar attack vectors.”
Evading stablecoin blocklists
Such exploits are unfortunately common in the largely permissionless DeFi sector. Yet, there are ways to potentially recover funds. Since they transact on publicly viewable ledgers, stolen assets can be tracked, enabling the industry’s centralized entities to blocklist exploit proceeds.
If an attacker deposits stolen funds on a centralized exchange, companies like Binance and Coinbase can simply freeze the assets and eventually return them to the compromised protocol. This makes it difficult to convert stolen crypto into traditional currencies like dollars or euros.
Similarly, stablecoin companies like Tether and Circle have some control over the assets they issue. By blocklisting an address, these firms can make the stablecoins USDT, USDC and others permanently inaccessible to an attacker.
However, immediately after the exploit, the attacker quickly deposited around $112 million worth of stolen stablecoins to a DeFi protocol called Curve, which would make recovering the funds more difficult. In his second thread, Gaevoy stated that the company would offer a 10% bounty for the funds’ return.
Beyond its CEO’s Twitter threads, Wintermute has not issued an statement about the exploit and none of the affected funds have been returned.
