Profanity: the vanity-address flaw behind the $160M Wintermute hack
Profanity generated custom "vanity" addresses with chosen prefixes. Its fatal flaw: every key it ever produced came from only 2^32 possibilities — and the process was reversible.
How the flaw worked
Profanity let users brute-force pretty addresses — say, one starting with seven zeros. To do that quickly it seeded a 256-bit mt19937_64 generator with a single 32-bit value from random_device. That means every private key it ever produced traces back to one of only 232 ≈ 4.3 billion seeds. Worse, the generator's steps are reversible, so an attacker can start from any Profanity-generated public address and walk backwards to the seed, then forwards to the private key.
The Wintermute hack
In September 2022, the market-maker Wintermute lost about $160 million. The attacker cracked a Profanity-generated admin wallet with a seven-zero vanity address. Wintermute had moved funds out of the hot wallet after 1inch published the flaw, but failed to revoke the wallet's admin permissions over their vault — so the recovered key was still enough to drain it.
Amber Group's technical breakdown →
The defense
Any address ever generated by Profanity should be considered compromised — move all funds and revoke every permission it holds. Vanity addresses are fine in principle, but only from a tool that draws full 256-bit entropy from a secure RNG.