Optimism Hacker - The Cyber Security Incident Database (CSIDB)

Attribution profile

Type: Hacker
Location: United States of America
Known incidents: 1 incident
Sources: 0 sources
First seen: 2022-06-09
Last seen: 2022-06-09
Updated: 2026-10-13 13:22
Aliases: 1 alias

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

The Optimism Hacker, also known by that alias, is a threat actor located in the United States of America. The actor’s only publicly reported activity occurred on 9 June 2022, when they exploited a flawed transaction involving liquidity provider Wintermute to withdraw 20 million OP tokens from the Optimism layer‑2 blockchain. Following a public plea from Wintermute’s CEO, the actor returned 17 million tokens, sent one million to Tornado Cash, and retained the remaining two million, which the project later described as a bounty. Victim confirmation of fund recovery and Wintermute’s commitment to reimburse the foundation followed the incident. No malware families, initial‑access vectors, or additional tooling beyond the transaction exploit and use of Tornado Cash are documented, and no state or criminal‑consortium affiliation has been publicly established.

Incidents

Attributed incidents are available to members.

1 incident

Sources

Sources available to members: 0 sources.