Optimism
Hack or exploit on Jun 5, 2022 · Multi-signature address transfer vulnerability
What happened
Optimism and Wintermute both released announcements, disclosing to the community a loss of 20 million OP tokens. At the time of the release of OP tokens, Optimism entrusted Wintermute to provide liquidity services for OP in the secondary market. As part of the agreement, Optimism will provide Wintermute with 20 million OP tokens. To receive the tokens, Wintermute gave Optimism a multi-signature address, to which Optimism transferred 20 million OPs after Optimism test sent two transactions and Wintermute confirmed it was correct. After Optimism transferred the coins, Wintermute found that they had no way to control these coins, because the multi-signature addresses they provided were only deployed on the Ethereum mainnet for the time being and have not yet been deployed to the Optimism network. To gain control of these tokens, Wintermute immediately initiated remediation operations. However, attackers have already noticed this vulnerability and deployed multi-signature to this address on the Optimism network before Wintermute, successfully controlling the 20 million tokens. At present, the Optimism hacker has returned 17 million OP tokens and transferred 1 million OP to the Vitalik address, and Vitalik has returned the funds.
Details
- Date
- Jun 5, 2022
- Kind
- Hack or exploit
- Method
- Multi-signature address transfer vulnerability
- How in
- Smart contract bug
- Target
- not stated
- Chains
- Optimism
After the theft
- Returned by the attacker
- yes, amount not stated
“At present, the Optimism hacker has returned 17 million OP tokens and transferred 1 million OP to the Vitalik address, and Vitalik has returned the funds.” (SlowMist Hacked)
Reported by
SwanBluechip, "Optimism hack, Jun 5, 2022: $1.6M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht4294eb9bb5/ (data as of 2026-10-31).