A brand new new crypto conspiracy theory is afoot — this time around with regards to last week’s $160 million hack on algorithmic market maker Wintermute — which crypto sleuth alleges was an “inside job.”
Cointelegraph reported on Sept. 20 that the hacker had exploited an insect inside a Wintermute smart contract, which enabled these to swipe over 70 different tokens including $61.4 million in USD Gold coin (USDC), $29.5 million in Tether (USDT) and 671 Wrapped Bitcoin (wBTC), worth roughly $13 million at that time.
Within an research into the hack published via Medium on Monday, the writer referred to as Librehash contended that because of the means by which Wintermute’s smart contracts were interacted with and eventually exploited, it shows that the hack was conducted by an interior party, claiming:
“The relevant transactions initiated through the EOA [externally owned address] allow it to be obvious the hacker was likely an interior person in the Wintermute team.”
The writer from the analysis piece, also referred to as James Edwards, isn’t a known cybersecurity investigator or analyst. Case study marks his first publish on Medium but to date hasn’t received any response from Wintermute or any other cybersecurity analysts.
Within the publish, Edwards shows that the present theory would be that the EOA “that made the phone call around the ‘compromised’ Wintermute smart contract was itself compromised through the team’s utilization of a faulty online vanity address generator tool.”
“The idea is the fact that by recovering the non-public key for your EOA, the attacker could call people around the Wintermute smart contract, which supposedly had admin access,” he stated.
Edwards continued to say that there isn’t any “uploaded, verified code for that Wintermute smart contract under consideration,” which makes it hard for the general public to verify the present exterior hacker theory, whilst raising transparency concerns.
“This, by itself, is a problem when it comes to transparency with respect to the work. You might expect any smart contract accountable for the treating of user/customer funds that’s been deployed onto a blockchain to become openly verified to permit everyone an chance to look at and audit the unflattened Solidity code,” he authored.
Edwards then entered a much deeper analysis via by hand decompiling the smart contract code themself, and alleged the code doesn’t complement what’s been related to resulting in the hack.
Related: Almost $1M in crypto stolen from vanity address exploit
Another point he raises questions regarding would be a specific transfer that happened throughout the hack, which “shows the change in 13.48M USDT in the Wintermute smart contract address towards the 0x0248 smart contract (supposedly produced and controlled through the Wintermute hacker).”
Edwards highlighted Etherscan transaction history allegedly showing that Wintermute had transferred greater than $13 million price of USDT from two different exchanges, to deal with a compromised smart contract.
“Why would they send $13 million dollars price of funds to some smart contract they *understood* was compromised? From TWO different exchanges?,” he asked via Twitter.
His theory has, however, not yet been corroborated by other blockchain security experts, although following a hack a week ago, there have been some rumors locally that the inside job could’ve been a possibility.
The truth that @wintermute_t used the profanity wallet generator and stored millions for the reason that hot wallet is negligence or perhaps an inside job. To worsen the vulnerability in profanity tool was disclosed a few days ago.
— Rotex Hawk (@Rotexhawk) September 21, 2022
Supplying an update around the hack via Twitter on Sept. 21, Wintermute noted that although it had been “very unfortunate or painful,” the remainder of its business is not impacted which continuously service its partners.
“The hack was isolated to the DeFi smart contract and didn’t affect any one of Wintermute’s internal systems. No 3rd party or Wintermute data was compromised.”
The hack was isolated to the DeFi smart contract and didn’t affect any Wintermute’s internal systems. No 3rd party or Wintermute data was compromised.
— Wintermute (@wintermute_t) September 21, 2022
After contacting Wintermute for discuss the problem, the firm emphatically refutes the allegations so it referred to as originating from “an unsubstantiated rumor from the Medium page which has factual and technical inaccuracies connected using the claims made. “
“Claims such as this require professional and independent fact-checking, so it appears obvious hasn’t happened here,” Wintermute stated.
