Thread by @ArkhamIntel

The Wintermute Hacker’s Next Move♟️

Following today’s $160 million Wintermute exploit, the hacker deposited nearly all of the obtained stablecoins into Curve's 3pool

It is likely the hacker did this to avoid having their $USDT and $USDC blacklisted by Tether & Circle.

Now that the stolen tokens are deposited into the pool, they can no longer be blacklisted.

However it remains unclear what the hacker's next move will be.

Though they may choose to redeem $DAI with their 3CRV, which cannot be blacklisted, such a move would be straightforward to trace on chain.

The Polynetwork hacker was the last to use the @CurveFinance 3pool in this way, in the 2nd biggest #DeFi hack in history.

During this exploit, @Tether_to blacklisted ~$33m of the stolen $USDT.

Soon after, the Polynetwork hacker successfully moved the rest of their stolen stablecoins into the pool.

However, they seemed to hit a snag in deciding what to do next.

Within days, the hacker returned the funds in exchange for a bounty.

While this could have been the goal all along, it is also possible they were unable to find a way to launder their funds from 3pool.

It remains to be seen what the Wintermute hacker will do.

Arkham will continue to monitor the situation & provide updates accordingly.