Wintermute Hack (September 2022 — $160M)

Approximately 96 hours before the exploit, Oracul registered unusual activity in testnets – a known staging ground for hackers. We observed increased interest in specific address-generation patterns. 24 hours before the event, Mempool analysis revealed suspicious pending transactions and abnormal activity in smart contracts linked to previous exploits.

What should have been done: Funds moved to multisig wallets, and internal transactions prioritized over the public queue.