Amber Group uses simple hardware to show just how fast, easy the Wintermute hack was

Amber Group has reproduced the recent Wintermute hack, the Hong Kong-based crypto finance service provider announced on its blog. The process was fast and simple, and used hardware easily accessible to consumers. Wintermute lost over $160 million in a private key hack on Sept. 20.

Reproducing the hack can help “build a better understanding of the attack surface spectrum across Web3,” Amber Group said. It was only hours after the hack of UK-based crypto market maker Wintermute was revealed that researchers were able to pin the blame for it on the Profanity vanity address generator.

One analyst suggested that the hack had been an inside job, but that conclusion was rejected by Wintermuteand others. The Profanity vulnerability was already known before the Wintermute hack.

classy

— wishful cynic (@EvgenyGaevoy) September 27, 2022

Amber Group was able to reproduce the hack in less than 48 hours after preliminary setup that took less than 11 hours. Amber Group used a Macbook M1 with 16GB RAM in its research. That was far speedier, and used more modest equipment, than how a previous analyst had estimated the hack would play out, Amber Group noted.

Related: The impact of the Wintermute hack could have been worse than 3AC, Voyager and Celsius — Here is why

Amber Group detailed the process it used in the re-hack, from obtaining the public key to reconstructing the private one, and it described the vulnerability in the way Profanity generates random numbers for the keys it produces. The group notes that its description “does not purport to be complete.” It added, repeating a message that has often been spread before:

“As well documented by this point — your funds are not safe if your address was generated by Profanity […] Always manage your private keys with caution. Don’t trust, verify.”

The Amber Group blog has been technically oriented from its inception, and has addressed security issues before. The group achieved a $3-billion valuation in February after a Series B+ funding round.