{"id":62763,"date":"2022-06-10T17:49:05","date_gmt":"2022-06-10T14:49:05","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=62763"},"modified":"2025-09-05T19:55:10","modified_gmt":"2025-09-05T16:55:10","slug":"hacker-returns-17-million-op-to-wintermute-market-maker","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hacker-returns-17-million-op-to-wintermute-market-maker\/","title":{"rendered":"Hacker returns 17 Million OP to Wintermute Market Maker"},"content":{"rendered":"<p>The hacker who stole 20 million OP from Wintermute sent one million tokens to Vitalik Buterin and signaled that he was prepared to return the remaining funds. After some time he <a href=\"https:\/\/optimistic.etherscan.io\/token\/0x4200000000000000000000000000000000000042?a=0x2501c477d0a35545a387aa4a3eee4292a9a8b3f0\">transferred<\/a> 17 million OP to the market maker.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"fr\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> Wintermute Exploiter has transferred 17 million <a href=\"https:\/\/twitter.com\/search?q=%24OP&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$OP<\/a> to <a href=\"https:\/\/twitter.com\/optimismPBC?ref_src=twsrc%5Etfw\">@optimismPBC<\/a> <a href=\"https:\/\/t.co\/5PpgeZXaId\">pic.twitter.com\/5PpgeZXaId<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1535240130809987073?ref_src=twsrc%5Etfw\">June 10, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On May 30, on the eve of<a href=\"https:\/\/forklog.com\/en\/news\/optimism-team-carried-out-airdrop-of-native-token\"> an airdrop<\/a>, the Optimism developers sent 20 million OP to the specified Wintermute multisig wallet. The market maker was chosen as the liquidity provider after the token&#8217;s listing on exchanges.<\/p>\n<p>Due to an internal error, the Wintermute team could not access the funds. However <a href=\"https:\/\/forklog.com\/en\/news\/unknown-hacker-steals-20-million-op-tokens-due-to-wintermutes-market-maker-error\">this was done by the hacker<\/a>, who took the assets under control. Of the total amount he spent 1 million tokens.<\/p>\n<p>On June 8, Wintermute published a statement detailing the incident and urged the hacker to return the remaining assets to the specified wallet to avoid legal consequences.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abWe are prepared to regard this as a white-hat exploit. Moreover, the method of attack was quite impressive. We may even consider consulting opportunities and other forms of cooperation in the future\u00bb, \u2014 said the market maker team.<\/p>\n<\/blockquote>\n<p>On June 10, the attacker <a href=\"https:\/\/optimistic.etherscan.io\/tx\/0x48464e4a6459062ac07efb4959fe8a6f90843f74922e68f71a929b33969f8f37\">sent 1 million OP<\/a> to an Optimism address, allegedly linked to the Ethereum co-founder. He accompanied the transaction with the signature:<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abHi, Vitalik. I believe in you; I just want to know your opinion about this. By the way, help verify the return address, and I will send the rest after you\u00bb.<\/p>\n<\/blockquote>\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/H4UPjZSsIGArQerS_DKmwQeSeUiuyaJN2kZsKlYpkHG9ez-X3wpzRxT9vLIjDb3aOu5W-gt_p9A1ltN5RaXVf5aa7bB_ctiA8ifJyyIul5329u1eFg34XCq96GcurFwdqHG2LOXjh8IeJQmtCQ\" alt=\"\u0425\u0430\u043a\u0435\u0440 \u0432\u0435\u0440\u043d\u0443\u043b 17 \u043c\u043b\u043d OP \u043c\u0430\u0440\u043a\u0435\u0442\u043c\u0435\u0439\u043a\u0435\u0440\u0443 Wintermute\"\/><figcaption>\u0414\u0430\u043d\u043d\u044b\u0435: Etherscan.<\/figcaption><\/figure>\n<p>The hacker also reached out to Wintermute and apologised that he could only return 18 million tokens.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abStay optimistic!\u00bb, \u2014 finished his message with the Optimism community&#8217;s slogan.<\/p>\n<\/blockquote>\n<p>As of writing, the assets he sent to the allegedly Buterin wallet remain unmoved.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> ~1m <a href=\"https:\/\/twitter.com\/search?q=%24OP&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$OP<\/a> still sit in Wintermute Exploiter&#8217;s address. <a href=\"https:\/\/twitter.com\/VitalikButerin?ref_src=twsrc%5Etfw\">@VitalikButerin<\/a> <a href=\"https:\/\/t.co\/91NsbxUQT2\">pic.twitter.com\/91NsbxUQT2<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1535245954873716736?ref_src=twsrc%5Etfw\">June 10, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\\\"https:\/\/platform.twitter.com\/widgets.js\\\" charset=\\\"utf-8\\\"><\/script><\/p>\n<p>In August 2021, the hacker returned all <a href=\"https:\/\/forklog.com\/en\/news\/poly-network-hacker-returns-the-remaining-141-million\">stolen digital assets worth $611 million<\/a> to Poly Network, which were stolen during one of the largest attacks in the history of the crypto industry.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The hacker who stole 20 million OP from Wintermute sent one million tokens to Vitalik Buterin and signaled that he was prepared to return the remaining funds. After some time he transferred 17 million OP to the market maker.<\/p>\n","protected":false},"author":1,"featured_media":62764,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,1362,1149],"class_list":["post-62763","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-optimism-op","tag-wintermute"],"aioseo_notices":[],"amp_enabled":true,"views":"9","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/62763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=62763"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/62763\/revisions"}],"predecessor-version":[{"id":62765,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/62763\/revisions\/62765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/62764"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=62763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=62763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=62763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}