Why This Hacker Sent 1M Optimism Tokens To Vitalik Buterin

The inventor of Ethereum Vitalik Buterin was the unintended recipient of 1 million OP tokens from this community’s scalability answer Optimism. The workforce behind this challenge addressed issues a few potential exploit associated to the launch of their governance token.

As clarified by Optimism, they entered a cope with liquidity supplier Wintermute to “facilitate a smoother experience for users” seeking to purchase OP and take part within the challenge’s governance mannequin. As a part of the settlement, Optimism despatched 20 million OP tokens to a multi-signature handle.

However, the liquidity supplier was unable to entry the funds because it found the handle was designed as an Ethereum layer-1 multi-sig with out an Optimism, which operates as a second layer answer, sensible contract deployment. About this, the liquidity supplier mentioned:

As we communicated the pockets handle to the Optimism workforce, we made a severe error.

The Optimism partnered started a “recovery operation” to realize entry to the funds, as they concluded with Wintermute that the funds “were potentially retrievable and that nobody other than Wintermute could recover those funds”, the liquidity supplier mentioned in a statement.

The restoration operation was scheduled, the liquidity supplier clarified, for June 7^th, 2022, however a hacker beat them to it. The workforce behind the Ethereum second layer answer defined:

Unfortunately, an attacker was capable of deploy the multisig to L2 with completely different initialization parameters earlier than these efforts had been accomplished, assuming possession of the 20m OP.

Furthermore, Optimism claims the attacker started promoting the stolen funds. As a lot as 1 million OP tokens have been “dumped” into the market from the hacker’s handle: 0x4f3a120E72C76c22ae802D129F599BFDbc31cb81.

At the time of writing, this handle nonetheless holds 18 million OP tokens or $14 million with a further $3 in USD Coin (USDC). However, new developments made the entire incident weirder.

Why Sent Part Of The Funds To Vitalik Buterin?

Developer Yoav Weiss, Security Fellow on the Ethereum Foundation, provided different particulars concerning the latest occasions. He believes the attacker could possibly be a Whitehat hacker.

He primarily based this presumption on the truth that the attacker waited 4 days earlier than taking possession of the OP funds. During that point, there was a threat that Wintermute may need deployed the answer to get better the funds.

In addition, the attacker hasn’t moved the funds, as Optimism believed. In step, the inventor of Ethereum Vitalik Buterin obtained 1 million tokens and Weiss himself obtained one other 1 million OP.

And the plot thickens. As I used to be scripting this explainer, the attacker delegated the 1M OP voting energy to *me*: https://t.co/75VPmS91J5

Thank you for delegating 🙂

Hint: no, I’m not the attacker and I do not know who’s. But now guessing it is a whitehat.

— yoav.eth (@yoavw) June 9, 2022

Projects typically ship Vitalik Buterin tokens to have a good time the launch of their platforms, or to “burn them”, because the inventor of Ethereum not often makes use of them. The indisputable fact that Weiss is a safety fellow appears to be a part of a message from the attacker.

The workforce behind Optimism claims the hacker has not used the funds for any exercise associated to its governance mannequin. If this case adjustments, they declare extra measures can be taken alongside the OP neighborhood.

Other measures can be found, however the Optimism workforce refuses to implement them and jeopardizes the challenge’s imaginative and prescient of a permissionless community. They concluded:

(…) incidents like this are the rising pains of an evolving trade. This is a reminder to everybody coping with contracts throughout completely different chains that the safety assumptions of 1 chain don’t essentially carry over to a different.

At the time of writing, OP’s worth trades at $0.8 with a 16% loss within the final 24-hours.