Wintermute Hack

REPORTED LOSS $160M
Critical Private Key Compromised (Brute Force) ethereum

What happened

On September 20, 2022, Wintermute suffered an approximately $160 million theft from its DeFi operations. Security researchers linked the compromise of a privileged wallet to Profanity, an Ethereum vanity-address generator with a serious weakness in its private-key generation.

Technical Root Cause

Profanity relied on a 32-bit seed and deterministic generation, leaving far less randomness than a securely generated Ethereum private key requires. A vulnerable wallet's administrator role extended the impact beyond its own balance to assets controlled by the vault. The reviewed analyses support the Profanity explanation but do not directly establish the attacker's exact key-recovery process.

Case & protocol details

Classification Infrastructure / CeFi,Yield Aggregator / Social Engineering
Protocol Type Exploit/Access control
Official Website www.wintermute.com/
Protocol Twitter/X @wintermute_t

How it happened

  1. Wintermute used Profanity to generate a wallet address beginning with repeated zeroes, according to the security analyses.
  2. Profanity's limited seed randomness made generated private keys vulnerable to recovery; researchers identified this as the likely route to the wallet compromise.
  3. The compromised address held administrator permissions on a Wintermute vault. Beosin's analysis identified calls from that address that transferred assets to an attacker-controlled contract.
  4. The theft caused an estimated $160 million loss across Wintermute's DeFi operations.

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks Phishing Attacks

Sources and on-chain records

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes