Hegic(old contract)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·67r97b…LQpSSummary
Hegic is an anonymous-founded, Ethereum-based decentralized options trading protocol originally launched in April 2020. The original (v1) smart contract suffered a critical code defect within hours of mainnet deployment that permanently locked user funds, compounded by misrepresentation of the pre-launch security review. A separate deprecated contract from January 2022 was additionally exploited in February 2025, draining approximately $80,000 in WBTC. While affected users were reimbursed out of team funds in both incidents, the underlying contracts remain permanently compromised.
Connected Entities
5 entities · 60 linked investigations- Wintermute→mentioned with→ZachXBT(60%)
- Wintermute→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Balancer→mentioned with→Ethereum(70%)
- Hegic(old contract)→mentioned with→Balancer(70%)
- Hegic(old contract)→mentioned with→Wintermute(70%)
- Hegic(old contract)→mentioned with→Ethereum(80%)
- Hegic(old contract)→mentioned with→ZachXBT(70%)
Timeline(12 events)
20 February 2020
Hegic protocol announced on EthResearch forum by anonymous developer Molly Wintermute.
April 2020
Trail of Bits conducts a 3-day code review of Hegic, identifying 10 critical flaws and recommending delayed deployment.
23 April 2020
Hegic v1 deployed to Ethereum mainnet despite Trail of Bits warnings; only a subset of identified critical flaws were patched.
24 April 2020
Critical bug discovered: a missing 's' in the function identifier 'OptionIDs' (should be 'OptionsIDs') permanently locks approximately $28,000–$48,000 in user ETH and DAI. Protocol taken offline.
26 April 2020
Hegic issues public apology retracting the 'typo' characterization and acknowledging a bug. Trail of Bits CEO Dan Guido publicly states the error would have been caught by basic unit testing and that Hegic misrepresented their code review as an 'audit.'
May 2020
New corrected Hegic contract deployed to mainnet. Affected users reimbursed 100% from Wintermute's personal and contributor funds.
9 September 2020
HEGIC governance token launched on Ethereum via bonding curve.
October 2020
Hegic v888 beta mainnet launched, supporting ETH and WBTC call and put options with staking and liquidity mining.
4 January 2022
Hegic deploys a WBTC Puts Pool contract (later described as a test/staging contract). The deployer address sends 1.1 WBTC to the contract; the contract is never formally decommissioned.
October 2022
Hegic deploys its current architecture, superseding prior contract versions.
23 February 2025
Attacker exploits the deprecated January 2022 WBTC Puts Pool contract via the `withdrawWithoutHedge` function, draining 1.1 WBTC (~$80,000). Incident flagged by BlockSec.
28 February 2025
Hegic publishes security report via Discord; confirms current architecture unaffected; announces bug bounty program.
Decision Log
- hash: CQYKWPf1agZ5pz59wg5LZAgYS5AgwMapWNmmniJRcBNA
This investigation is cryptographically anchored to the Solana blockchain (1 event). 11 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:25 AM
last updated: 8/29/2026, 12:34:19 PM
5 viewsavoid.net — verified advice for a post-truth world