Solana Records DeFi Outflows Up to $100 Million Following Recent Hack

Mango Markets was robbed of $100 million in funds by an exploit in the second $100 million DeFi hack this week. Mango Markets announced Tuesday evening that a hacker was able to drain funds from the company using Oracle price manipulation.

Last Thursday, $100 million was stolen from another DeFi protocol, Binance Smart Chain. According to OtterSec, a blockchain auditing website, the attacker temporarily increased the value of their collateral before borrowing from the Mango treasury. Mango Markets is a Solana-based platform for trading digital assets for spot margin and perpetual futures on the Solana blockchain. Mango DAO governs Mango Markets.

“At 6:19 PM ET, an attacker funded account A with 5mm USDC collateral,” Genesis Global Trading’s Head of Derivatives, Joshua Lim, tweeted.

According to Lim, the attacker then sold 483 million units of MNGO perps (perpetual contracts) on the Mango Markets order book. The attacker then funded another account with 5 million USDC collateral at 6:24 PM ET to purchase those 483 million MNGO perps for $0.03 per unit.

The attacker began moving the Mango spot market price at 6:26 PM ET, driving the price to $0.91 and the value of the 483 million MNGO to $423 million.

After that, the attacker borrowed $116 million, leaving Mango’s treasury with a negative balance of -116.7 million. All of Mango’s liquidity was drained: USDC, MSOL, SOL, BTC, USDT, SRM, and MNGO were all drained. In response, Mango Markets has disabled deposits and is attempting to freeze third-party funds.

A Twitter user pointed out that the attacker received 5.5 million dollars from FTX, prompting FTX CEO Sam Bankman-Fried to respond by saying that the company is looking into it. Mango Markets has offered the attacker a bug bounty in exchange for the return of the stolen funds.

Image Credit: Shutterstock