Wintermute (Optimism OP grant) hack — June 2022

In May 2022 the Optimism Foundation lent market maker Wintermute 20 million OP tokens from its Partner Fund so Wintermute could provide liquidity when OP listed on centralised exchanges. Wintermute supplied a Gnosis Safe address it controlled on Ethereum mainnet but had never deployed on Optimism. The Foundation sent the tokens to that address on the layer-2 on 27 May 2022, where they sat at a contract that did not yet exist.

On 5 June 2022 an attacker took them. As Inspex documented, the Gnosis Safe proxy factory on Ethereum had originally been deployed in transactions predating EIP-155 and therefore carrying no chain ID, so the attacker replayed those transactions to recreate the factory at the identical address on Optimism. They then generated roughly ten thousand Safe contracts across dozens of transactions until the deployer's nonce produced Wintermute's exact address, and deployed a Safe they owned there.

Published valuations of the 20 million OP differ sharply because OP had only just begun trading and was falling fast. Crypto Briefing put the loss at about $17.6 million on the day, CoinDesk reported $15 million, and Decrypt described the tokens as worth $35 million at the time of the breach. The token quantity is not disputed.

The attacker converted 1 million OP to ether, sent 1 million OP to Vitalik Buterin's wallet with an on-chain message, and on 10 June returned 17 million OP, about $15.6 million at that day's price, keeping 2 million as a self-declared bounty. The Optimism Foundation said the 1 million OP sent to Buterin was also being recovered. Wintermute chief executive Evgeny Gaevoy accepted responsibility, calling it a serious error, and the firm undertook to make Optimism whole.