The Optimism Foundation confirmed in a press release that they sent 20 million OP tokens to the incorrect multi-sig wallet despite completing two test transactions.
The Optimism Foundation made a statement clarifying that 20 million OP tokens intended for a liquidity provisioning partner were transferred to the incorrect address. After the news leaked, the price of the OP token dropped from $1.12 on June 8 to $0.70.
According to the statement, Wintermute was hired by the Optimism Foundation to provide liquidity provisioning services and received a temporary gift of 20 million OP tokens from the Foundation's Partner Fund.
Wintermute gave an address where the borrowed tokens might be delivered. The Optimism Foundation sent two separate test transactions, then sent the rest once Wintermute confirmed each.
Unfortunately, Wintermute later learned that they were unable to access these tokens since they had provided an address for an Ethereum (L1) multisig that had not yet been deployed to Optimism (L2).
Note that Wintermute claims to be a "leading worldwide algorithmic market maker in digital assets," but it has committed a basic blunder in crypto, particularly for an algorithmic market maker.
In exchange, Wintermute said that it has committed to repurchasing the tokens lost. "They will keep an eye on the address that contains the lost tokens and buy when the address sells," Wintermute said.
Wintermute Attempted to Rectify the Matter
According to Optimism, Wintermute attempted to rectify the matter without repurchasing the tokens by "starting a recovery operation to deploy the L1 multisig contract to the same address on L2."
However, Optimism asserted that an attacker was able to deploy the multisig to L2 with different initialization parameters before these efforts were completed, assuming ownership of the 20 million OP tokens.
By deploying an Optimism L2 contract to the address, Wintermute effectively left 20 million OP tokens on the street for anyone to pick up.
As a result, referring to the new owner as an "attacker" could be interpreted as a PR ploy, calling into question the authenticity of the "exploit" or "hack." Since then, Optimism has announced that 1 million OP have been sold from the wallet.