According to Etherscan data, the transfer occurred at 12:26 AM UTC, with the attacker sending tokens worth $874,000. It's unclear why they transferred the Optimism tokens to Vitalik Buterin wallet after selling a significant portion. One factor could be that the coins are largely illiquid on decentralized exchanges due to the lack of liquidity and cannot be sold for much currently. Yoav Weiss, an Ethereum Foundation security researcher, also received the voting rights for the 1 million tokens from the exploiter. Buterin had earlier delegated to Weiss his 1,746 OP tokens from the Optimism airdrop.
Weiss has tweeted that he is not the hacker but that the individual could be a white hat hacker. Wintermute made a mistake, which led to the attack. Optimism granted the crypto market maker a grant of 20 million OP tokens in exchange for a multi-signature Ethereum address that had yet to be put on the Optimism network. Because of this oversight, the hacker could claim the undeployed address on Optimism and steal all of the funds.
Wintermute claims to have purchased the 1 million tokens that the attacker promptly sold after the exploit. Wintermute has invited the hacker to restore the stolen OP tokens and has offered the hacker a consultancy position. The exploiter has one week to react to Wintermute's offer, but with this additional money delivered to Buterin, they now only have 18 million of the stolen 20 million in their wallet.