A conspiracy theory claiming that the $160 million Wintermute breach was an inside job was recently disproven by BlockSec — a blockchain security company — as the supporting evidence is “not convincing enough.”
Cyber investigator James Edwards published a report earlier this week raising concerns surrounding the affected smart contract and two stablecoin transactions in particular, alleging that the Wintermute smart contract exploit was probably carried out by someone with inside knowledge of the company.
After reviewing the claims, BlockSec wrote on Medium that the “accusation of the Wintermute project is not as solid as the author claimed.” It later tweeted that its analysis has proven that the report is “not convincing enough” to point fingers at the Wintermute project.
In Edward’s initial post, he highlighted how the hacker was able to inflict such havoc on the compromised Wintermute smart contract, which allegedly had admin access, despite providing no indication of admin skills throughout his investigation.
However, BlockSec swiftly disputed the assertions. The security firm stated “the report just looked up the current state of the account in the mapping variable _setCommonAdmin, however, it is not reasonable because the project may take actions to revoke the admin privilege after knowing the attack.”
It referred to information about the Etherscan transaction that revealed as soon as Wintermute learned of the exploit, it had revoked admin credentials.
Edwards also raised suspicions of foul play when he questioned why Wintermute had Tether (USDT) valued at $13 million transferred from two of its accounts to two different exchanges to their smart contract barely two minutes after it had been hacked.
In response, BlockSec rebutted that this is not suspicious as the hacker could be keeping an eye out for Wintermute transferring transactions — probably with the help of bots. Case in point, it mentioned the existence of on-chain MEV-bots that continuously track transactions in order to earn profits.
