Worked example · 2022-09

Profanity vanity-address cohort — Ethereum — 2022-09-15 to 2022-12 (cohort case)

Loss: ~$3.3M+ extracted from non-Wintermute Profanity-affected wallets across the cohort window — primarily concentrated in the 2022-09-15 to 2022-09-20 phase per Cointelegraph cohort tracking, with smaller residual extractions from un-rotated Profanity-affected addresses through the remainder of 2022. The cohort total is bounded below by the publicly reported ~$3.3M figure for the September window; the full-year cohort tail is documented as illustrative but is not aggregated to a single dollar figure in the public record.
OAK Techniques observed: OAK-T11.004 (Insufficient-Entropy Key Generation) as the canonical sub-Technique anchor; OAK-T11 broadly construed for the cross-cutting custody-surface-vulnerability framing (same Technique mapping as the canonical Wintermute case at examples/2022-09-wintermute.md). The cohort is the worked example for the publicly-known-vulnerability-not-rotated operational pattern in the small-and-mid-tier-victim regime; the Wintermute case is the worked example for the same pattern in the large-institutional-victim regime.
Attribution: pseudonymous — multiple pseudonymous attackers, not publicly named. Some commentators speculated G01 / Lazarus involvement on the basis of the laundering-route similarities for the higher-value extractions, but the attribution was not confirmed by any authoritative source and the cohort spans more than one operator playbook (small extractions consistent with opportunistic exploitation; larger extractions consistent with more sophisticated targeting). OAK records the cohort as pseudonymous / multiple-actor.
Cohort framing: this is a cohort case, distinct from the per-incident worked-example shape used for canonical Technique pages. The cohort case captures the N-of-many failure-mode pattern — a publicly-disclosed cryptographic vulnerability with explicit rotation guidance, exploited rapidly across a population of un-rotated victims. Wintermute (canonical incident at examples/2022-09-wintermute.md) is the highest-profile member of this cohort; this worked example documents the cohort around Wintermute that is not adequately captured by a single-incident frame.
Key teaching point: The Profanity cohort case is OAK's canonical worked example for the publicly-known-vulnerability-not-rotated operational pattern in its cohort regime. It pairs with the Wintermute canonical-incident worked example to capture the same Technique-class failure mode at two scales: institutional (Wintermute, ~$160M, large-institutional response timeline) and population (cohort, ~$3.3M+ across many small-and-mid-tier victims, operational-rotation-discipline timeline). The two-scale framing is what makes the operational lesson actionable: the half-life of known vulnerabilities after disclosure is non-trivial across the population of affected operators, and the institutional-response failure mode (Wintermute's partial response) is one specific instance of a much broader rotation-discipline failure that affects the cohort tail.

Summary

On September 15, 2022, the 1inch Network published a public disclosure ([1inchprofanity2022]) of a cryptographic vulnerability in Profanity, an open-source Ethereum vanity-address generator. Profanity seeded its CPRNG with a 32-bit unsigned integer, reducing the effective key-generation entropy to roughly 2^32 (~4.3 billion) values. The disclosure included a proof-of-concept private-key recovery and explicit guidance to "transfer all of your assets to a different wallet ASAP."

In the five-day window between disclosure and the headline Wintermute incident on 2022-09-20, approximately $3.3M was extracted from other Profanity-generated wallets across the Ethereum ecosystem. Cointelegraph and other contemporaneous sources tracked the cohort-level extraction. The victims were a heterogeneous mix:

Individual users with Profanity-generated vanity addresses holding ETH and ERC-20 balances.
Smaller DeFi project deployer / admin addresses with Profanity-generated vanity formats (chosen for gas-saving leading-zeros, the same operational rationale Wintermute applied at scale).
A long tail of smaller smart-contract interactions where the Profanity-generated address held authority over deployed contracts, allowing the attacker to reach assets at the contract layer rather than just the EOA layer.

The cohort tail extended well beyond the September window. Through the remainder of 2022 and into 2023, additional small-scale extractions from un-rotated Profanity-affected addresses continued to be reported sporadically. The full-year cohort tail is not aggregated to a single dollar figure in the public record but is documented as illustrative of the half-life-of-known-vulnerability-after-disclosure problem: even after the vulnerability was widely publicised and rotation guidance was unambiguous, a non-trivial fraction of affected addresses remained un-rotated and continued to be drained over time.

For OAK's purposes, the cohort case is the worked example for the publicly-known-vulnerability-not-rotated operational pattern in its small-and-mid-tier-victim regime. The Wintermute incident is the worked example for the same pattern in the large-institutional-victim regime. The two are structurally identical at the Technique layer (T11 broadly construed, insufficient-entropy key generation) but differ at the operational / response layer in ways defenders should not collapse — the cohort tells a different story about who fails to rotate keys after disclosure, and that story is what makes the cohort case worth documenting alongside Wintermute rather than absorbing into it.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Profanity tool widely used across the Ethereum ecosystem (2017-onward) for vanity-address generation; gas-saving leading-zeros patterns common operational practice	(latent vulnerability — pre-disclosure window)
2022-09-15	1inch Network publishes public disclosure of the Profanity 32-bit-seed CPRNG vulnerability with proof-of-concept key recovery and explicit rotation guidance (`[1inchprofanity2022]`)	(public disclosure)
2022-09-15 to 2022-09-20	~$3.3M extracted from non-Wintermute Profanity-affected wallets across the cohort; Cointelegraph and other industry press track the cohort-level extraction in near real-time	T11 broadly construed (cohort extraction phase 1)
2022-09-20	Wintermute DeFi vault drain (~$160M) — canonical large-institutional incident in the cohort, documented at `examples/2022-09-wintermute.md`	T11 broadly construed (large-institutional anchor)
2022-09-20 onward	Increased ecosystem-wide rotation activity following the Wintermute disclosure; cohort extraction rate slows but does not stop — un-rotated Profanity addresses continue to be drained sporadically through Q4 2022 and into 2023	T11 broadly construed (cohort extraction tail)
2022-09 to 2022-12	Multiple pseudonymous attackers active across the cohort window; some larger extractions show laundering-pattern similarities to G01 playbook but no confirmed attribution; smaller extractions consistent with opportunistic exploitation by independent actors	(attribution: pseudonymous / multiple-actor)
Subsequent	Full-year cohort tail not aggregated to a single dollar figure in the public record; cohort serves as the canonical illustration of "publicly-known-vulnerability-not-rotated" half-life	(operational-pattern documentation)

What defenders observed

Pre-event (custody-surface configuration): Profanity-generated vanity addresses were widely deployed across the Ethereum ecosystem. The pre-event signal was not a defender-side observation about Profanity specifically — Profanity was open-source and its CPRNG seeding was visible to anyone reading the code, but the cryptographic implication (effective entropy below the curve floor) was not widely understood until 1inch's disclosure. The pre-event signal a third-party defender could read was the cohort size — the population of Profanity-generated addresses with non-trivial balances, enumerable from on-chain analysis once the address-generation pattern was published.
Public disclosure window (2022-09-15 to 2022-09-20): the disclosure made the cohort-size signal actionable. Defenders monitoring the ecosystem for cohort-level exploitation could observe the ~$3.3M of extractions from Profanity-affected addresses in near real-time. This was the operational signal that exploitation was active and ongoing — and was the basis on which the Wintermute incident's partial response (move ETH out of the directly-exposed hot wallet, but do not revoke admin authority) should have been judged inadequate at the time, not in retrospect.
Cohort-level extraction shape: the cohort extractions clustered toward smaller-balance addresses in the immediate post-disclosure window — consistent with attackers who had pre-computed Profanity-affected address keys at scale and were extracting in a "drain-as-many-as-possible-before-they-rotate" sweep. The larger extractions later in the window (and the Wintermute event itself) required more targeted analysis (identification of admin / deployer addresses with substantial downstream authority) and were operationally distinct from the opportunistic sweep phase.
Cohort tail (2022-Q4 and beyond): the extended tail of small-scale extractions from un-rotated Profanity-affected addresses is the load-bearing observation about operational rotation half-life. Even after a high-profile, widely-publicised cryptographic vulnerability with explicit rotation guidance — and after a $160M institutional incident illustrating the consequences — a non-trivial fraction of affected addresses remained un-rotated and continued to be drained over time. The half-life-of-known-vulnerability-after-disclosure is materially longer than defender intuition suggests; the Profanity cohort is the cleanest illustration in the public record.

What this example tells contributors writing future Technique pages

Cohort cases are a distinct worked-example shape and warrant distinct framing. Most OAK worked examples are per-incident — a single victim, a single extraction, a single set of attribution facts. Cohort cases capture the N-of-many shape: a population of victims, multiple extractors, a single underlying vulnerability class. Contributors writing future cohort cases (drainer-affected-wallet cohorts, oracle-thinness-affected-protocol cohorts, deprecated-library-affected-deployer cohorts) should reach for this worked example as the comparison reference for how to structure cohort framing without pretending it is a single incident.
Cohort + canonical-incident pairs are useful structural devices. The Profanity cohort + Wintermute pair is the v0.1 model: the canonical-incident worked example (Wintermute) carries the institutional-scale Technique-page anchor function; the cohort worked example (this file) carries the population-scale operational-pattern documentation. The pair allows OAK to preserve both the headline-case visibility and the cohort-tail operational lesson without forcing one shape to do the work of both. Future T11 / T9 / T10 cases where a cohort-around-the-canonical exists should use the same pair structure.
Half-life-of-known-vulnerability-after-disclosure is a defender-relevant operational metric. The Profanity cohort tail is the v0.1 evidence that this metric is non-trivial (extractions continued for months after disclosure). Contributors writing future Technique pages should consider including a post-disclosure-tail observation in the Detection section where the relevant cohort data exists — it is one of the few defender-relevant operational metrics that captures the operational rotation discipline of an entire victim population rather than the per-incident response.
Multiple-actor cohort attribution is a stable category. Where a cohort is attacked by more than one operator playbook (opportunistic sweep + targeted institutional extraction), forcing a single actor attribution is misleading. The Profanity cohort case is the v0.1 example of multiple-pseudonymous attribution — multiple actors, multiple playbooks, single underlying vulnerability class. Contributors writing future cohort cases should reach for this framing rather than collapsing to a single-attacker narrative.

Public references

[1inchprofanity2022] — 1inch Network primary disclosure of the Profanity 32-bit-seed CPRNG vulnerability with proof-of-concept private-key recovery and explicit rotation guidance (2022-09-15). Primary citation for the public-disclosure-with-rotation-guidance starting point of the cohort window.
[halbornwintermute2022] — Halborn technical post-mortem of the Wintermute incident; canonical large-institutional anchor for the cohort and the function-level walkthrough of the un-rotated-admin-authority failure mode.
[cointelegraphprofanitycohort2022] (proposed) — Cointelegraph contemporaneous coverage of the cohort-level extraction in the 2022-09-15 to 2022-09-20 window; primary public-record source for the ~$3.3M cohort figure and the cohort-tracking framing.
[halbornprofanitytool2022] (proposed) — Halborn companion post-mortem on the Profanity tool itself (separate from the Wintermute write-up); function-level explanation of the 32-bit-seed CPRNG flaw and the GPU-feasible private-key recovery.
[theblockprofanity2022] (proposed) — The Block contemporaneous reporting of the 1inch disclosure and the cohort exploitation; complementary same-week industry coverage.

Discussion

The Profanity cohort case is OAK's canonical worked example for the publicly-known-vulnerability-not-rotated operational pattern in its cohort regime. It pairs with the Wintermute canonical-incident worked example to capture the same Technique-class failure mode at two scales: institutional (Wintermute, ~$160M, large-institutional response timeline) and population (cohort, ~$3.3M+ across many small-and-mid-tier victims, operational-rotation-discipline timeline). The two-scale framing is what makes the operational lesson actionable: the half-life of known vulnerabilities after disclosure is non-trivial across the population of affected operators, and the institutional-response failure mode (Wintermute's partial response) is one specific instance of a much broader rotation-discipline failure that affects the cohort tail.

The cohort case also makes a structural argument that contributors should preserve: not every worked example needs to be per-incident. The OAK examples library is overwhelmingly per-incident at v0.1 — the Profanity cohort is one of a small number of cohort-shape worked examples (along with, arguably, address-poisoning cohorts and drainer-affected-wallet cohorts). The v0.1 evidence is that cohort cases capture operational-pattern observations (half-life-of-disclosure, cohort-tail rotation discipline, multiple-actor cohort attribution) that per-incident cases cannot, and the framework should preserve room for both shapes.

A reasonable open question for future OAK iterations is whether the publicly-known-vulnerability-not-rotated operational pattern should be promoted from a recurring observation in worked examples to an explicit cross-cutting axis at the framework level — a Maturity: or Operational: sub-classification that runs orthogonal to the Tactic / Technique grid. The Wintermute discussion notes the same open question; the cohort case strengthens the argument by making the population-scale evidence visible. The v0.1 decision is to keep the pattern at the worked-example layer and cross-reference between cases (Wintermute, Mango Markets, Profanity cohort, future T9 / T10 / T11 cases) where the pattern recurs. A v1.0-era taxonomy decision is whether this becomes a first-class framework axis.

Contributors writing future cohort-shape worked examples should:

Pair the cohort with a canonical-incident worked example where one exists; do not try to absorb the canonical incident into the cohort framing or vice versa.
State the cohort dollar-figure as a lower bound when the public-record aggregation is incomplete; do not invent a precise full-year figure.
Mark attribution explicitly as multiple-pseudonymous where the cohort spans more than one operator playbook; do not collapse to a single-attacker narrative.
Document the cohort tail (post-canonical-incident extractions from un-rotated victims) as the half-life-of-known-vulnerability evidence; this is the load-bearing operational lesson and is materially different from the canonical-incident-response-timeline evidence.