Wintermute: The Market Maker Turning Crypto Chaos Into a Weapon

When the Market Maker Becomes the Market

Crypto never sleeps—but some players seem disturbingly awake when everyone else is drowning.

In the dead of night on May 9, 2022, as the Terra-Luna ecosystem imploded and retail traders watched their portfolios vanish, Wintermute was feasting. The London-based market maker—now one of the most dominant forces in digital asset trading—ran over $250 million in arbitrage trades in mere hours. They scooped UST at $0.80, flipped it into $1 worth of Luna, dumped it, and pocketed a clean 10–15% profit per cycle.

“We made tens of millions,” CEO Evgeny Gaevoy said publicly. No shame. No disguise. Just raw, unapologetic profit.

That moment didn’t just show Wintermute’s speed. It exposed a deeper truth: this firm doesn’t just survive chaos—it thrives on it. And each crisis raises the same uncomfortable question for regulators and traders alike:

When does “market making” turn into market abuse?

The Spark That Set Crypto on Fire

Last Friday, crypto lost hundreds of billions in hours. But the real shock wasn’t the crash—it was the source.

On-chain analysts traced the initial domino to a single withdrawal: 1,066 BTC pulled from Coinbase and routed straight through Wintermute. Minutes later, Donald Trump issued a market-shaking public statement—and prices tanked.

The timing was almost too perfect.

Theories spread like wildfire: Was this a premeditated short-selling event? Did someone know ahead of time what Trump was about to say? And did that someone share his last name?

One viral analysis painted the scene plainly: “An insider knew Trump was going to tweet, contacted the market maker to sell. The market maker thought, ‘I have plenty of coins too—I’ll dump and profit.’”

Here’s the grenade: allegedly, Wintermute didn’t just sell. It stopped providing liquidity. Without its endless bids and asks supporting price levels, the market collapsed through every floor. Liquidations exploded. Retail accounts were slaughtered.

Three questions lit up crypto Twitter:

Did projects relying on Wintermute as a market maker crash harder than others?
Who was the American who initiated the BTC sale?
Has Wintermute become a systemic risk—so large that if it falls or acts maliciously, the entire market can implode?

These are explosive claims—and still unverified. But the pattern isn’t new. It’s just scaling up.

Targeting the “Uninformed Flow”

Gaevoy has a chilling phrase for the traders his firm feeds on: “uninformed flow.” Translation? Retail.

Unlike competitors who hide behind euphemisms like “liquidity provision,” Wintermute brags about baking embedded call options into token deals—letting them dump at price highs. Gaevoy even admits it “affects market fairness.”

It’s rare honesty in an industry that prefers polished PR. But transparency doesn’t make the behavior ethical.

By late 2025, accusations of exploitation had become routine. Analysts pointed to a September 2025 crash that wiped out $1.7B in leveraged positions. Charts showed massive inflows of BTC, ETH, and SOL into Wintermute wallet clusters right before prices nosedived. Traders called it a “retail squeeze.”

The Friday crash? If early interpretations are correct, it was that strategy on steroids—with potential advance political intel mixed in.

Celsius: Where Smoke Meets Fire

Wintermute’s most serious legal threat came quietly from the wreckage of Celsius.

In 2023, creditors filed an amended lawsuit in U.S. District Court alleging Wintermute colluded with Celsius executives to wash trade the CEL token—artificially inflating volume and manipulating price from 2021 until Celsius collapsed.

Internal Celsius chats supposedly revealed the scheme.

Wintermute denied everything. The case remains unresolved.

But here’s what stings: just months later, the FBI launched Operation Token Mirrors, charging 18 people and four market makers for systematic wash trading. Wintermute wasn’t charged—despite being accused of similar behavior.

Either Wintermute is clean… or it’s just too nimble to catch.

A $160M Hack Exposes Reckless Decisions

On September 20, 2022, hackers drained $160 million from Wintermute’s hot wallets.

Hacks happen—but this one was preventable.

Five days earlier, Wintermute had been explicitly warned that the Profanity vanity address generator was compromised. They moved some ETH but—unbelievably—left the vulnerable address as an admin on their vault contract. Attackers used it to drain $118.4M.

Worse: Wintermute chose Profanity to save gas fees, even though it used a weak 32-bit seed.

They risked nine figures to shave pennies.

Was this negligence—or arrogance?

Governance Games and Power Plays

August 2023 showcased Wintermute’s appetite for soft power. They proposed borrowing 350 YFI (worth ~$2.1M) from Yearn Finance at 0.1% annual interest with no collateral. The DeFi community erupted.

“Against decentralization at its core,” one voter blasted.

DWF Labs swooped in with a better offer, embarrassing Wintermute and showcasing their willingness to leverage influence for near-free capital.

Crypto saw the move for what it was: predatory extraction masked as protocol partnership.

Crisis as a Business Model

Wintermute doesn’t wait for chaos. It plans for it.

April 2025: FDUSD depegs to $0.87. Wintermute instantly moves $75M, squeezes $3M in arbitrage.
October 2025: $500B wiped from global crypto market cap. Wintermute deposits $700M into Binance right before prices fall. Traders swear the firm pulled liquidity and stopped defending levels, letting ATOM and SUI free-fall.

Coincidence keeps looking like strategy.

Now add Friday’s crash. If Wintermute truly had advance notice of a political shockwave and amplified the collapse by withdrawing liquidity, this isn’t just predatory—it’s weaponized market control.

Masterclass in Regulatory Evasion

In March 2025, Wintermute met with the SEC, claiming they’d avoided the U.S. out of fear of “arbitrary and capricious” enforcement under the previous administration.

The irony? They’re now allegedly tied to a market event involving a member of that same administration.

Wintermute plays the regulatory game flawlessly:

Base operations in friendly jurisdictions
Trade on U.S. exchanges anyway
Influence U.S. markets indirectly
Avoid U.S. legal exposure

It’s regulatory arbitrage, and it’s brilliant—unless you’re the one getting liquidated.

Notably, when 51 major firms—including Coinbase and Circle—signed the 2025 Crypto Market Integrity Coalition framework, Wintermute refused.

They don’t want voluntary standards. They want unconstrained freedom.

Too Big to Fail—or Too Dangerous to Tolerate?

Wintermute claims $3 trillion in cumulative volume and 313% OTC growth in 2024. Their reach is undeniable.

But power without accountability becomes a weapon.

If one market maker can move billions, withdraw liquidity, front-run events, and trigger cascading liquidations—are they providing liquidity… or holding markets hostage?

Crypto has tolerated “aggressive” firms for years. But Friday felt different.

This time the questions hit harder: Who sold that Bitcoin? Who knew Trump was about to speak? Did Wintermute exploit that knowledge while pulling liquidity from the very markets it claims to support?

The Reckoning Ahead

Gaevoy built Wintermute to be faster, sharper, and more unapologetic than anyone else. And he succeeded.

But bragging about targeting “uninformed flow” isn’t edgy—it’s predatory. Profiting from collapses isn’t clever—it’s destructive. Dodging every major enforcement while skating the edge of manipulation isn’t brilliance—it’s a systemic risk.

Crypto must decide what it wants to be.

A mature market with real standards? Or a shooting gallery where the biggest gun slaughters everyone else?

Friday’s crash—already dubbed the “biggest tragedy in crypto history” by some—may finally force that decision.

Because Wintermute didn’t just break the market.

It proved one terrifying truth: The house always wins—unless someone finally regulates the house.