Frodan's Blog

Writeup for "Rabbithole" Wintermute Alpha 2025

 
  • Sep 01, 2025

Rabbithole

Task

It turns out that Vyper has a bug, and some of the Curve pools were vulnerable, so you observed how, despite whitehat efforts, three different pools were drained. A few days later, you found that exploiters returned funds for two of them, but what about the “CRV/ETH one”? You have reasons to believe that this exploiter is responsible for some of the other DeFi exploits that have occurred in the same year.

Please provide at least two examples (with different exploiter EOAs) of the previous exploits with Etherscan links and the reasoning that proves connections (some high-level details about the methodology could be helpful for solidifying proofs as well). You can’t use any data after 5th August, 2023 to prove your points.

Solution

Initial Analysis of CRV/ETH Exploiter

To find other attacker wallets, I researched behavior patterns and unique markers that differentiate this exploiter from other hackers.

Key points for hacker activities:

  • Deposit address (ETH needed for gas fees)
  • Exploit execution (the most important indicator)
  • Withdrawal address
  • Transaction behavior patterns

Deposit

The initial deposit came from Binance, likely to bypass security monitoring since Binance deposits are typically considered safe. While monitoring systems focus on Tornado Cash, Railgun, FixedFloat, and other mixers, the attacker probably used fake KYC documents to fund through Binance. Deposit

Withdrawal

Stolen funds moved to “CRV/ETH Exploiter 2”, but only 1,500 ETH went through Tornado Cash. The remaining stolen funds still sit in the wallet for unknown reasons. CRV/ETH Exploiter 2

Activity Before the Hack

This account was initially created to attack the MiningRig contract. The attacker began preparing on July 28 but was too slow. c0ffeebabe.eth exploited it first on July 29 (potentially frontrunning other hackers). This suggests the CRV/ETH exploiter was trying to exploit an already known vulnerability.

The CRV/ETH Exploiter drained what remained, obtaining 32.291419732496523585 ETH (~$60K at that time) - modest profit for a hacking operation. Transaction example

The Hack Itself

The attacker didn’t discover the Vyper vulnerability independently. At least 5 different actors had already exploited it, with Twitter buzzing about the bug. The CRV/ETH Exploiter simply wrote his own exploit for this known vulnerability.

Timeline spreadsheet Timeline

Once the Vyper reentrancy vulnerability went public, every second counted. The attacker likely reused this wallet for the CRV/ETH attack to save time on anonymous deposits.

Exploit Techniques

Each exploit contract used the same unique obfuscation: double keccak256 hashing with bytes manipulation for owner checks, preventing MEV bots from frontrunning the exploit. Keccak

Attacker Markers

After the review, I identified the following attacker markers:

  • Double keccak256 (most unique identifier)
  • Binance deposits for funding
  • Multiple hacks from the same wallet
  • Delayed withdrawals via separate wallets
  • Targets small projects without audits
  • Accepts small profits (<$100k per hack)
  • Drains leftover funds from other hackers’ exploits

Hack Research

I reviewed Ethereum Q1-Q2 2023 hacks using the BlockThreat newsletter archive. After several hours of research, I discovered that double keccak check is incredibly unique - it appears almost exclusively in wallets with similar attacker markers.

I identified 7 accounts with very similar characteristics.

Note: I define malicious wallet activity as exploit creation and execution transactions only. Swaps and withdrawals are excluded since attackers often wait extended periods before moving funds.

Case #1

Attacker EOA: 0xceed34f03a3e607cc04c2d0441c7386b190d7cf4
Activity Period: 2022-11-04 to 2023-01-26

Shared Characteristics with CRV/ETH Exploiter

  • Binance funding
  • Double keccak checks in exploit (without bytes manipulation - likely improved in later attacks as this was deployed end of 2022)
  • Funds partially remain in exploit contracts
  • Multiple hacks from the same address
  • Targets low-cap tokens

Attack Examples

The attacks included manipulation of different token pairs ($CANDLE, $BCI, $RINU). This account has an extensive history with many hacked protocols:

Additional Behavioral Insights

This wallet’s activity confirmed my initial markers and revealed new patterns:

  • Confirmed: Same account used for multiple hacks over extended periods
  • Confirmed: Targets any vulnerable protocol, regardless of potential profit (some yielded <$100)
  • New marker: Never uses self-destructing contracts, despite their popularity at the time

Case #2

Attacker EOA: 0xdbdf5f801da11d65fe9b1d449cbed6ebe2f04fd3
Activity Period: 2023-04-09 to 2023-04-24

Shared Characteristics with CRV/ETH Exploiter

  • Binance funding
  • Double keccak checks in exploit
  • Multiple hacks from the same address
  • Withdrawal via Tornado Cash
  • Targets low-cap tokens

Attack Examples

Case #3

Attacker EOA: 0x3bfe2a46f0050c76ea95b65abfa826bbfb27596d
Activity Period: 2023-04-27 to 2023-04-28

Shared Characteristics with CRV/ETH Exploiter

  • Binance funding
  • Double keccak checks in exploit
  • Funds partially remain in exploit contracts
  • Exploits vulnerabilities after other hackers
  • Targets low-cap tokens

Attack Examples

Case #4: Start of BSC Operations

Attacker EOA: 0x2d2bcd3caed4b51b7090c78cfd73ea091a4b44de
Activity Period: 2023-04-03 to ~2023-05-06
Note: Unlike mainnet operations, the attacker used Tornado Cash deposits on BSC instead of Binance across all identified wallets.

Shared Characteristics with CRV/ETH Exploiter

  • Double keccak checks in exploit
  • Multiple hacks from the same address
  • Withdrawal via Tornado Cash
  • Targets low-cap tokens

Attack Examples

Case #5

Attacker EOA: 0x054a3574d8082112575843dd944ff42c58dda38d
Activity Period: 2023-05-21 to 2023-05-24

Shared Characteristics with CRV/ETH Exploiter

  • Double keccak checks in exploit
  • Multiple hacks from the same address
  • Targets low-cap tokens

Attack Examples

Case #6

Attacker EOA: 0x0A3feE894eb8fCB6f84460d5828d71Be50612762
Activity Period: 2023-05-28 to 2023-06-01

Shared Characteristics with CRV/ETH Exploiter

  • Double keccak checks in exploit
  • Multiple hacks from the same address
  • Targets low-cap tokens

Attack Examples

Case #7

Attacker EOA: 0x0060129430df7ea188be3d8818404a2d40896089
Activity Period: 2023-06-02 to 2023-06-10

Shared Characteristics with CRV/ETH Exploiter

  • Double keccak checks in exploit
  • Multiple hacks from the same address
  • Targets low-cap tokens

Attack Examples

Conclusion

The attacker demonstrated consistent behavior patterns across all cases:

  • Target selection: Focus on low-security projects without audits
  • Profit tolerance: Willing to exploit for minimal profits (<$100)
  • Attack type: Primarily liquidity/reward manipulation attacks
  • Technical signature: Unique double keccak256 owner check implementation
  • Wallet management: Rotating hot wallets for multiple consecutive hacks
  • Account migration: Clear chronological progression from one account to another
  • Withdrawal pattern: Delayed withdrawals while continuing attacks from new wallets
  • Funding sources:
    • Mainnet: Binance deposits (likely using fake KYC)
    • BSC: Tornado Cash deposits
Search