DeFi Platform Mango Markets Hit By $100M Hack

• Mango Markets was drained of $100 million in funds due to an exploit.
• It remains unclear how, exactly, the attacker managed to inflate MNGO’s value in the eyes of the Mango protocol.

The Solana-based DeFi trading platform Mango markets is the most recent of a large exploit that has resulted in a loss of $100 million. This happened to be the second hack in a week affecting the crypto space.

Mango Markets is a Solana-based platform for trading digital assets on the Solana blockchain for spot margin and trading perpetual futures. Mango Markets is governed by Mango DAO. Mango Markets provides a single venue to lend, borrow, swap, and leverage-trade crypto assets through a powerful risk engine.

We are currently investigating an incident where a hacker was able to drain funds from Mango via an oracle price manipulation.

We are taking steps to have third parties freeze funds in flight. 1/

— Mango (@mangomarkets) October 11, 2022

Mango Markets tweeted Tuesday evening that a hacker was able to empty funds from Mango via an oracle price manipulation.

Only last Thursday,$100 million was stolen from the Binance Smart Chain, another DeFi protocol. This makes the Mango market hack the second swindling event to occur this week.

According to the blockchain auditing website OtterSec, the attacker temporarily drove up the value of their collateral and then took out loans from the Mango treasury.

At 6:19 PM ET, an attacker funded account A with 5mm USDC collateral,

The Head of Derivatives at Genesis Global Trading, Joshua Lim, tweeted.

The attacker offered out $483 million units of MNGO perpetual contracts on the Mango Markets order book. Then at 6:24 PM ET, the attacker funded another account with $5 million USDC collateral to buy those $483 million units of MNGO perps for $0.03 per unit.

At 6:26 PM ET, the hacker then started moving the Mango spot market price, driving the price to $0.91 and the value of the $483 million MNGO to $423 million.

The attacker took out a $116 million loan, leaving Mango’s treasury with a negative balance of -116.7 million. Assets drained include USDC, MSOL, SOL, BTC, USDT, SRM, and MNGO, wiping out all of Mango’s liquidity.

Attacker was funded 5.5M from @FTX_Official

Sam?https://t.co/nDuOwTPmcyhttps://t.co/tkX19jLMps

@SBF_FTX https://t.co/JyNeRwUa58

— wainuo (@ChenWainuo) October 11, 2022

A Twitter user noted that the attacker was funded 5.5M from FTX, prompting FTX CEO Sam Bankman-Fried to respond that the company is investigating.