Audit log

Every state-changing event for Wintermute: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 18:58:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-beta

   sig

   38s69PfndPM2…xRQwooPjcopyexplorer ↗

   hash

   2dBNSyGvxMJT…6czMwZtpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6317 B) ▸

   {"actor":"system:backfill","investigation_id":"c0832d18-9663-491d-8289-727146536eaf","kind":"publish","page_slug":"wintermute","published_at":"2026-05-20T18:58:59.439Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wintermute","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/09/20/crypto-market-maker-wintermute-hacked-for-160m-says-ceo"},{"credibility":3,"name":"","type":"other","url":"https://www.wintermute.com/insights/market-color/reports/wintermute-otc-2024-in-review-2025-outlook"},{"credibility":3,"name":"","type":"other","url":"https://www.tradersmagazine.com/featured_articles/wintermute-expands-into-u-s-makes-new-policy-hire/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.1inch.com/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-wintermute-hack-september-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/uGiY0j3hwOzQOMcDPGoz9-wintermute-hack"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/cyber-sleuth-alleges-160m-wintermute-hack-was-an-inside-job"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/09/20/crypto-market-maker-wintermute-hacked-for-160m-says-ceo"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/1inch-severe-vulnerability-ethereum-vanity-address-tool-risks-millions-dollars/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.numencyber.com/an-analysis-of-wintermutes-usd160-million-hacking/"},{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-analysis-of-wintermute-attack"},{"credibility":3,"name":"","type":"other","url":"https://immunebytes.com/blog/wintermute-crypto-exchange-hack-sep-20-2022-detailed-analysis/"},{"credibility":3,"name":"","type":"other","url":"https://quillaudits.medium.com/wintermutes-160m-exploit-analysis-quillaudits-f1dbd217b9f9"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/10/14/crypto-market-maker-wintermute-pays-off-96m-truefi-debt-weeks-after-being-hacked"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/wintermute-repays-92m-truefi-loan-on-time-despite-suffering-160m-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/09/20/hacked-crypto-market-maker-wintermute-has-200m-in-outstanding-defi-debt"},{"credibility":3,"name":"","type":"other","url":"https://www.sec.gov/files/ctf-written-wintermute-11172025.pdf"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-wintermute-hack-september-2022"},{"credibility":3,"name":"","type":"other","url":"https://safeheron.com/blog/how-profanity-caused-wintermute-to-lose-160m/"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/170359/1inch-claims-potential-exploit-on-profanity-generated-ethereum-addresses"},{"credibility":3,"name":"","type":"other","url":"https://blockbytes.com/2023/02/13/crypto-casefiles-wintermute-hack/"}]}],"sources_used":[],"summary":"Wintermute is a London-headquartered algorithmic trading firm and cryptocurrency market maker founded in 2017 by Evgeny Gaevoy. On September 20, 2022, the firm's DeFi operations were exploited for approximately $160 million after an attacker leveraged a known cryptographic vulnerability in the Profanity vanity address tool to compromise Wintermute's admin private key. The stolen funds were never recovered, though the firm remained solvent, repaid its outstanding DeFi loans, and has continued operating and expanding into U.S. markets.","timeline":[{"date":"2017-01-01","event":"Wintermute founded in London by Evgeny Gaevoy, formerly of Optiver's European ETF desk.","source":""},{"date":"2022-09-15","event":"1inch Network publicly discloses a severe cryptographic vulnerability in Profanity, the Ethereum vanity address generator, recommending all users immediately transfer funds away from Profanity-generated addresses.","source":""},{"date":"2022-09-15","event":"Profanity vulnerability exploited by separate actors draining approximately $3.3 million from other wallets, establishing proof of exploitability before the Wintermute attack.","source":""},{"date":"2022-09-20","event":"Attacker uses a reconstructed private key from a Profanity-generated Wintermute admin wallet to drain approximately $160 million from Wintermute's DeFi vault across roughly 90 ERC-20 token types.","source":""},{"date":"2022-09-20","event":"CEO Evgeny Gaevoy publicly discloses the hack via Twitter, confirms solvency, and characterizes the incident as a potential white-hat event, offering the attacker a 10% bounty to return funds.","source":""},{"date":"2022-09-20","event":"Attacker routes approximately $114 million in stablecoins through Curve Finance 3pool to complicate asset freezes.","source":""},{"date":"2022-09-27","event":"Researcher 'Librehash' alleges via social media that the hack was an inside job based on alleged anomalous pre-hack transactions; Wintermute denies the allegation. BlockSec assesses the inside-job theory as unsubstantiated.","source":""},{"date":"2022-10-14","event":"Wintermute repays its $96 million TrueFi DeFi loan one day before deadline, demonstrating continued solvency following the hack.","source":""},{"date":"2023-01-01","event":"Stolen $160 million remains unrecovered; attacker's 10% white-hat bounty offer unclaimed. Wintermute resumes normal operations.","source":""},{"date":"2025-02-01","event":"Wintermute opens U.S. headquarters in New York City, expanding OTC and derivatives offerings.","source":""},{"date":"2025-09-03","event":"Wintermute submits formal feedback to the SEC Crypto Task Force, arguing network tokens should not be classified as securities.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9e5054ad-b822-4cc4-be91-7904c04ea807copy
2. #2rescoreby systemsystem

   2026-10-10 18:47:11Z
   Score: 38 → 64 (+26)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 64. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,367,092

   sig

   4RQis7Vqo3dn…RBVdwQhAcopyexplorer ↗

   hash

   Fz8N9eW7HSRw…xqt6hT9Fcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (608 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:47:11.813Z","decision":"rescore","investigation_id":"c0832d18-9663-491d-8289-727146536eaf","new_score":64,"page_slug":"wintermute","prev_score":38,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 64. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.","score_delta":26,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2bebb94e-6b30-4976-88a1-b67cfe92cde1copy
3. #3reviewby reviewerreviewer

   2026-11-02 03:28:12Z
   Score: 64 → 64 (no score change)
   The core narrative of the Profanity key compromise, the retained admin permission, the ~$160M loss and the TrueFi repayment is supported by sources I read. Two defects: the TrueFi loan principal is inconsistent across sources ($96M vs $92M), and the SEC citation points to the October follow-up letter rather than the September 3 submission the timeline describes. Coverage was a sample, not exhaustive; several on-chain figures and the OTC growth claim were not checked. The subject is still operating, with no contradiction from current status.
   anchoranchored

   chain

   ●mainnet-betaslot 464,344,063

   sig

   3DxpMdUu5FMV…ekvBV3nvcopyexplorer ↗

   hash

   NeW4U9oLTVwj…2N3GHYkbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1394 B) ▸

   {"actor":"reviewer","artifact_identity":"201b5c6c246aa69e63deaef8ee29e4ee","decided_at":"2026-11-02T03:28:12.055Z","decision":"review","disputed_pct":0.25,"findings_hash":"FycPyDcYpuhyLfhnP8XNFwmsc1CUD1f3WBX7ERkFWYWR","investigation_id":"c0832d18-9663-491d-8289-727146536eaf","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":64,"omissions":{"material":0,"total":2},"page_content_hash":"6ae4d5e8a6c235413afee999abce2e64d26fc58739b0a144565a5eb2c49324e7","page_slug":"wintermute","prev_score":64,"reason":"The core narrative of the Profanity key compromise, the retained admin permission, the ~$160M loss and the TrueFi repayment is supported by sources I read. Two defects: the TrueFi loan principal is inconsistent across sources ($96M vs $92M), and the SEC citation points to the October follow-up letter rather than the September 3 submission the timeline describes. Coverage was a sample, not exhaustive; several on-chain figures and the OTC growth claim were not checked. The subject is still operating, with no contradiction from current status.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4397376f-200c-4221-8509-50ae0402e122copy
4. #4review reviseby judgejudge

   2026-11-02 03:28:12Z
   Score: 64 → 64 (no score change)
   The core account of the September 2022 Profanity key compromise and the retained admin permission was confirmed against a Tier 2 source (claim_findings[0]). Of four sampled claims, none were disputed outright and one could not be checked (claim_findings[3], the 313% OTC growth figure), giving 25% unverified, which falls in the minor-issues band. Two claims are only partly supported: the TrueFi loan is given as $96M while the body of the CoinDesk article and the cited Cointelegraph URL say $92M (claim_findings[1]), and the SEC citation points to an October 27, 2025 follow-up letter rather than the September 3 filing the timeline describes (claim_findings[2]). The omissions found (a 2026 broker-dealer registration and market-making conduct allegations) are minor, and the subject is still operating, so the penalty is kept small given the reviewer's moderate confidence.
   anchoranchored

   chain

   ●mainnet-betaslot 464,344,068

   sig

   eFK9uNWwxNEw…Y9t8nGh6copyexplorer ↗

   hash

   B5r1RrmYHMwH…a4Jw2jz8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1520 B) ▸

   {"actor":"judge","artifact_identity":"201b5c6c246aa69e63deaef8ee29e4ee","band_override":null,"decided_at":"2026-11-02T03:28:12.055Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"c0832d18-9663-491d-8289-727146536eaf","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":64,"page_slug":"wintermute","prev_score":64,"reason":"The core account of the September 2022 Profanity key compromise and the retained admin permission was confirmed against a Tier 2 source (claim_findings[0]). Of four sampled claims, none were disputed outright and one could not be checked (claim_findings[3], the 313% OTC growth figure), giving 25% unverified, which falls in the minor-issues band. Two claims are only partly supported: the TrueFi loan is given as $96M while the body of the CoinDesk article and the cited Cointelegraph URL say $92M (claim_findings[1]), and the SEC citation points to an October 27, 2025 follow-up letter rather than the September 3 filing the timeline describes (claim_findings[2]). The omissions found (a 2026 broker-dealer registration and market-making conduct allegations) are minor, and the subject is still operating, so the penalty is kept small given the reviewer's moderate confidence.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5dc85700-7e35-4e7d-bdd7-e03e61dcc9decopy
5. #5rescoreby systemsystem

   2026-11-02 03:28:13Z
   Score: 64 → 65 (+1)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 64 → 65. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −0.8; legitimacy credit long-running +10; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,344,073

   sig

   5dvbw3bfxrHa…dTzfR2jVcopyexplorer ↗

   hash

   8RKyAWNKef6k…fd75iHpXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (718 B) ▸

   {"actor":"system","decided_at":"2026-11-02T03:28:12.055Z","decision":"rescore","investigation_id":"c0832d18-9663-491d-8289-727146536eaf","new_score":65,"page_slug":"wintermute","prev_score":64,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 64 → 65. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −0.8; legitimacy credit long-running +10; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ab74339c-6b88-4bf2-874f-543559f05b28copy