dYdX V3 Hack — November 17, 2023
Overview
On November 17, 2023, the protocol suffered a massive exploit, which resulted in the theft of $9 million. Around $9 million in dYdX v3's insurance fund — roughly 40% of its total v3 funds — was used to process liquidations after an organized attack.
Attack Details
The attacker appeared to have a clear strategy: build leveraged long positions on dYdX v3 prior to purchasing $SUSHI and $YFI spot. The price moves in $SUSHI and $YFI were possibly due to some combination of an organic price move and the attacker's coordinated aggressive buying in spot markets.
The alleged attack targeted long positions in YFI tokens on the exchange, liquidating positions worth nearly $38 million. The actor was able to withdraw a good amount of $USDC from dYdX right before the price crash.
Impact
The attacker managed to withdraw approximately $27 million from dYdX v3, having initially deposited around $16 million. The attacker's trading activities led to a more than $9 million drain from the insurance fund. A week before the YFI incident, the hacker targeted SUSHI/USD using the same strategy and made a profit of about $5 million.
Investigation
dYdX revealed that it had uncovered the identity of the hacker and that it was in contact with them. dYdX said it is currently helping law enforcement agencies with their ongoing investigation regarding the hack. The exchange said it is also considering taking legal action against the attackers.
Sources