Security

Profanity Vanity Address Vulnerability: What Happened in 2022

How Profanity's 32-bit seed made private keys recoverable, its link to the $160M Wintermute hack, and what to do if you used the tool.

By EthVanity editorialUpdated November 9, 20267 min readRead as Markdown

What key verification proves. Derivation: The key corresponds to the displayed address; Randomness: A match does not audit the random source; Exposure: A matching address does not prove key secrecy.Open full-size diagram (SVG)Download diagram (PNG)About these visual guides

Short answer: Profanity, a GPU vanity address generator, seeded each 256-bit private key from only a 32-bit random value, so about 4 billion starting points covered every key it could produce. 1inch disclosed in September 2022 that keys could be recovered from a public key, and days later Wintermute lost about $160 million from a Profanity-style vanity address. Anyone who used Profanity should move all funds to a new, properly generated address.

What Profanity was and why people used it

Profanity was an open-source, OpenCL-based vanity address generator for Ethereum written by the GitHub user johguse. It ran on GPUs and was popular for producing addresses with long prefixes and, in particular, addresses with many leading zeros, which projects used to save gas on calldata, as explained in leading-zero addresses and gas.

Its speed came from a standard trick: start from one private key, derive its public key once, then repeatedly add the curve generator point, which is equivalent to incrementing the private key by one. This is efficient and not unsafe on its own. The flaw was in how the starting private key was chosen.

The weakness: a 32-bit seed for a 256-bit key

A secure private key needs 256 bits of unpredictability. According to the 1inch disclosure published on September 15, 2022, Profanity initialized its random generator with a single 32-bit value. That allows only 2^32, about 4.29 billion, distinct seeds. From each seed the tool expanded about 2 million starting private keys and then incremented them during the search.

The consequence is that every key Profanity could ever output lies on a relatively small set of known paths. An attacker who knows a target's public key, which is revealed by any transaction the address has signed, can work backwards along those paths until they reach a seed-derived starting point and thereby recover the private key. 1inch noted that recovery takes computational effort comparable to generating the vanity address in the first place, which is well within reach of GPU clusters.

This article deliberately describes the problem at a conceptual level only. The lesson is general: the number of possible outputs of a key generator equals the number of possible seeds, regardless of how long the resulting key looks.

Quantity	Secure generator	Profanity
Seed entropy	256 bits	32 bits
Possible starting points	About 1.16 x 10^77	About 4.29 x 10^9 seeds
Recoverable from public key	No	Yes, with large GPU effort

Timeline: from disclosure to the Wintermute exploit

The sequence below uses dates from the 1inch disclosure, the Profanity repository and contemporaneous reporting by The Block.

September 15, 2022: 1inch publishes its disclosure. The same day, the Profanity author removes the binaries, archives the repository, leaves it uncompilable and writes that he strongly advises against using the tool.
Days after disclosure: 1inch reports that deployers of several projects had already been drained, and estimates total losses could reach tens or hundreds of millions of dollars.
September 20, 2022: market maker Wintermute loses about $160 million from its DeFi operations. Its founder, Evgeny Gaevoy, puts the figure at $162.2 million and says the firm had used Profanity-type tools to create addresses for gas optimization.
Following weeks: researchers at Amber Group reproduce recovery of the private key for the Wintermute-related vanity address 0x0000000fe6a514a32abdcdfcc076c85243de899b in under 48 hours on an Apple MacBook, according to The Block. Wintermute did not publish a formal post-mortem confirming the cause at the time.

Lessons for choosing a vanity generator

The Profanity failure was not about speed, GPUs or vanity addresses as such. It was a randomness failure. The same check applies to any tool, including ones that run in a browser: where does the starting key come from, and how many bits of entropy does that source provide?

Prefer generators whose code is open source and whose key initialization is easy to audit; the seed must come from the operating system's cryptographically secure random source.
Prefer split-key designs. 1inch's profanity2 fork takes a seed public key you created and outputs only an offset; your final key is your private seed plus the offset modulo the curve order, so the person running the search never learns your key. The repository is now archived, but the design principle remains useful.
For contract addresses, avoid key generation entirely by mining a public CREATE2 salt, as compared in EOA vs CREATE2 vanity.
Never use an online service that generates the full private key on its server, and never reuse a key that has been shared with anyone.

How to tell whether an address may be affected

There is no on-chain flag that marks a Profanity key, so assessment starts with provenance. If you cannot say which tool and version generated a vanity key, treat it as potentially vulnerable. Addresses with long prefixes or many leading zeros that were produced with GPU tools before September 2022 deserve particular suspicion, because Profanity was the dominant GPU option at the time.

Exposure of the public key matters. An attacker needs the public key, which appears on-chain as soon as the address signs a transaction and can also be recovered from signed off-chain messages. An address that has signed anything should be considered exposed. Waiting is not a defense, because recovery can be performed later against any public key already published.

Wallet keys from Profanity: create a new wallet and move every asset, including NFTs and tokens on other EVM chains where the same key controls the same address.
Contract owner or admin keys from Profanity: call the ownership transfer or role-granting functions to move control to a hardware wallet or multisig, then renounce the old roles.
Unknown provenance: plan a migration anyway; the cost of moving funds is small compared with an irreversible loss.
Contracts deployed at vanity addresses via CREATE2 salts are not affected by the key flaw, because no private key was generated for the address.

What to do if you used Profanity or a similar tool

1inch's guidance is direct: if a wallet was created with Profanity, move all assets to a new wallet as soon as possible, and if a vanity contract's owner or admin address came from Profanity, transfer ownership to a safe address. Do this even if the address has never been drained; recovery only requires a public key, and attackers can process targets at any time.

Generate the new address with a standard wallet from a fresh recovery phrase or on a hardware wallet. Revoke token approvals granted by the old address, because an attacker with the key could otherwise use them before you finish. Then update every place that references the old address, including ENS records and allowlists, and treat the old address as permanently compromised. If you plan to import a replacement vanity key, follow the precautions in importing a private key into MetaMask.

Explore the related mechanism

How Ethereum Addresses Are Derived from a Private Key — From secp256k1 private key to Keccak-256 hash, last 20 bytes and EIP-55 checksum, with an ethers v6 example and why it is one-way.
Ethereum Vanity Address Difficulty: Attempts, Odds and Time — How hard is an Ethereum vanity address? 16^n expected attempts, EIP-55 case factors, prefix plus suffix, success odds and search time.
Open the complete workflow guide to place these checks in order.
Open the address generator when you have chosen a compatible format and pattern.

Frequently asked questions

Is every Ethereum vanity address unsafe because of Profanity?

No. The flaw was specific to Profanity's 32-bit seeding. An address generated with a full 256-bit cryptographically secure seed is as secure as any other address.

Can an attacker recover the key of an address that never sent a transaction?

The attack needs the public key, which becomes visible on-chain once an address signs a transaction. Do not rely on this: public keys can leak through signed messages too, and 1inch advises moving funds regardless.

How much was stolen in the Wintermute hack?

Widely reported figures are about $160 million, with Wintermute's founder citing $162.2 million. Researchers linked it to a Profanity-type vanity address, though Wintermute did not publish an official post-mortem at the time.

Is profanity2 safe to use?

Its split-key design means the search operator never learns your private key, as long as you generate the seed key securely yourself. The 1inch repository is archived and no longer maintained, so check for a maintained successor before use.

Does the Profanity flaw affect vanity contract addresses?

Only through keys. A contract mined with a CREATE2 salt involves no private key. But a contract whose owner, admin or deployer key came from Profanity is at risk, and 1inch advises transferring ownership to a safe address.

Sources and editorial method

The technical references below support the concepts discussed in this article. Examples and comparison worksheets are explanatory, not measured service benchmarks.

Read how these articles are prepared.