- A hacker exploited dYdX’s v3 trading platform, causing a $9 million loss to the DEX’s insurance fund through a coordinated attack using overleveraged positions across multiple wallets
- The attacker initiated many 5x leveraged long YFI/USD positions across 100+ wallets to manipulate prices and multiply unrealized profits, reaching $50 million exposure before the price dropped 30%
- dYdX upgraded to v4 with enhanced monitoring, automatic margin adjustments, and other measures to prevent similar exploits, but investigations continue as they consider legal action against the attacker
Decentralized exchange dYdX was recently targeted by a coordinated attack on its v3 trading platform, leading to a $9 million loss from its insurance fund. The exchange has now identified the attacker and is considering legal action.
The Method Behind the Exploitative Attack
The attacker initiated many 5x leveraged long positions using the YFI/USD trading pair across over 100 wallets. By using various addresses, the attacker purchased a large amount of YFI tokens, leading to a 215% increase in the token’s price.
The attacker then multiplied their unrealized profits by entering additional YFI/USD positions, reaching a maximum exposure of around $50 million. dYdX raised margin requirements and lowered position sizes to limit the attacker’s activities.
When YFI’s price dropped 30% the next day, the attacker was unable to close their positions. The insurance fund automatically covered the resulting losses. A similar strategy targeting SUSHI/USD the previous week had yielded the attacker $5 million in profits.
dYdX Responds and Improves Security
dYdX stated that the attacks did not affect customer funds, and the attacker did not profit from manipulating the YFI market. To prevent similar exploits in the future, dYdX has upgraded its trading platform.
The new v4 chain includes enhanced open-interest monitoring, alerts, and automatic adjustments to margin requirements in response to abnormal price changes. These measures aim to mitigate risks and prevent coordinated attacks using overleveraged positions.
While investigations continue, dYdX urges users to interact only through official channels to avoid scams. The exchange promises to reveal further details once its examination of the exploit is complete.
