Optimism hack loses 20 million OP tokens worth $35 million

Optimism’s native OP token suffered a $35 million loss when 20 million tokens were mistakenly sent to an unsynced Ethereum address and promptly stolen by a hacker on June 1 2024 [2].

How the loss occurred

Optimism, an Ethereum layer‑2 scaling solution, intended to airdrop 20 million OP tokens to its DAO stakeholders via market maker Wintermute. The transfer was sent to Wintermute’s Ethereum (L1) address, but because the address had not been linked to an Optimism (L2) address, the tokens remained on L1 and were inaccessible. Within 24 hours, an anonymous actor seized the entire 20 million‑token batch, selling 1 million on the market while retaining the remaining 19 million [2].

Immediate fallout and response

Wintermute confirmed the error on May 30 and later disclosed that the stolen tokens could not be recovered through a high‑risk operation. The market maker has since repurchased the 1 million OP tokens sold by the hacker, but the remaining 19 million remain missing. Optimism reports that the stolen tokens have not yet been used to influence DAO governance, though the incident underscores the heightened risk profile of layer‑2 operations that bypass Ethereum’s congested mainnet [2].

What to watch

• Token unlocks: Monitor any future OP token unlock schedules that could affect supply dynamics once the missing tokens are accounted for.
• Governance activity: Watch for any OP voting proposals that might be impacted if the missing tokens reappear or are burned.
• Security audits: Track announcements of additional security audits or bridge hardening measures from Optimism and Wintermute.

The hack illustrates that while layer‑2 solutions promise faster, cheaper transactions, they also introduce new vectors for loss when address synchronization fails, raising questions about the robustness of scaling infrastructure as Ethereum adoption grows.