20 Million OP Stolen: The Lost History and the Latest Progress

Early this morning, Optimism and cryptocurrency market maker Wintermute revealed that 20 million Optimism tokens were stolen by hackers.

Affected by this incident, OP once fell below 0.7USDT, and now it has risen to 0.82USDT, a 17% drop in 24h.


Cryptocurrency market maker Wintermute sent a letter to the Optimism community claiming responsibility for the blunder.

Event Timeline

Two weeks ago, the Optimism Foundation hired Wintermute to provide liquidity for its OP token listed on the centralized exchange. As part of the agreement, Wintermute received 20 million OP.

Initially, 20 million OP will be deployed in Wintermute’s Optimism wallet. We made a serious mistake when we communicated the wallet address to the Optimism team. We had Gnosis Safe deployed on mainnet for a while and due to an internal bug we were using the same wallet as the receiving address. However, unlike normal wallets, having control over the mainnet Safe does not guarantee control over other EVM compatible chains.

We notified the Optimism team on May 30th. Since the next day’s Launch has been confirmed, we agreed to receive an additional 20 million OP (offering $50 million as collateral) while exploring ways to get the funds back. At the same time, we contacted the Gnosis Safe team and asked for their assistance in recovering the funds. After consulting with the Optimism and Safe teams, Wintermute has assessed that these funds are likely to be recovered and that no one but Wintermute can recover these funds. The assessment also considered that this was a high-risk retrieval, only attempted once, and required Safe support. Remediation is scheduled for June 7. However, the assumption that funds could only be recovered by Wintermute proved wrong.


However, less than 24 hours after we notified Safe and Optimism, wallet 0x8BcFe4f1358E50A1db10025D731C8b3b17f04DBB was funded via Tornado Cash. It continued the replay attack by resetting the ETH mainnet’s Gnosis Safe MasterCopy 1.1.1 deployment. They then deploy the vault using the previously deployed contract 0xE7145dd6287AE53326347f3A6694fCf2954bcD8A. The hacker then went on to sell 1 million OP tokens for ETH and bridged back to L1 via Synapse and Hop before using Tornado Cash on mainnet.

what we plan to do about it

As of this writing, the attacker still has 19 million OP tokens. We’re not sure why they chose not to liquidate all at once. Hopefully this is a white hat bug, in which case the remaining funds may be recoverable. We haven’t heard from them, though, and our on-chain messages have gone unanswered.

We would like to clarify one thing – the initial mistake is 100% Wintermute’s fault, so we will be buying every time an attacker sells OP (we did start buying the millionth OP token yesterday). We know it may cause price volatility in the token and will do our best to minimize the impact.

message to hackers

We like to think of it as a white hat exploit. Also, the way the attack was performed is so impressive that we might even consider future consulting opportunities or other forms of collaboration, hoping that the remaining 19 million tokens will be returned to the Optimism wallet: 0x2501c477d0a35545a387aa4a3eee4292a9a8b3f0.

You have a week to think about it, and if the above doesn’t happen, we’re 100% committed to returning all funds, tracking the attackers, fully human-testing them and handing them over to the appropriate justice system. The Optimism team has already started investigating potential leads, in some cases without notifying respective law enforcement agencies. 

In addition to the 1 million OP sold, the data on the Optimism chain shows that the hacker address of the 20 million OP theft incident officially announced by Optimism has now sent 1 million OP to the Buterin wallet 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045. As of now, the hackers still hold 18 million OPs, and Buterin has not yet responded to the matter.

latest progress

In addition to the 1 million OP sold, the data on the Optimism chain shows that the hacker address of the 20 million OP theft incident officially announced by Optimism has now sent 1 million OP to the Buterin wallet 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045. As of now, the hackers still hold 18 million OPs, and Buterin has not yet responded to the matter.


The Optimism official foundation tweeted that it recommends all teams pursuing a cross-chain strategy: 1. Do not assume that control between L1 and L2 is always guaranteed. Please pay special attention to old smart contract wallets that may not be able to take advantage of create2. 2. Ethereum is a “dark forest”, and anyone who can preempt it will preempt it. Move fast in a rescue operation because you never know who’s staring at the blockchain. 3. Multi-chain introduces new considerations and problems. Application developers should seriously consider multi-chain contexts and how applications behave on multiple chains, especially in the context of deterministic deployment, create2, and context-specific behavior.

In principle, a network upgrade could be done to stop the movement of those OP tokens that have not been transferred or sold. As it would set a precedent, we are not taking this step at this time. Optimism is a permissionless network that behaves as expected.

Additionally, the Optimism Foundation has given Wintermute a second short-term grant of 20 million OP so they can continue to work as things develop. This contact is temporary in nature. The community should not expect or rely on the Optimism Foundation to support future liquidity provisioning efforts.

The Foundation also notes that the Wintermute team is world-class and that events like this are a growing pain for an ever-evolving industry. This reminds everyone dealing with contracts across different chains that the security assumptions of one chain do not necessarily carry over to another. Currently, most of the OP in question has not moved. Both the Optimism and Wintermute teams are closely monitoring the situation. While the situation continues, we hope to share this overview with the community in a spirit of openness and transparency.

According to Twitter user @kelvinfichter, these are growing pains in a multi-chain world. This is an unfortunate event, but it underscores the importance of designing systems for multi-chain users. CREATE2 and deterministic deployments are critical, especially for contract wallets. If using a multi-signature wallet on Ethereum, it is highly recommended to take the time to understand the security properties of the wallet and whether the wallet will be controlled on a chain other than Ethereum.

Posted by:CoinYuppie,Reprinted with attribution to:https://coinyuppie.com/20-million-op-stolen-the-lost-history-and-the-latest-progress/
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.

Like (0)
Donate Buy me a coffee Buy me a coffee
Previous 2022-06-08 23:49
Next 2022-06-09 10:22

Related articles