DYDX Releases Post Mortem Report About November Hack

Popular decentralized exchange dYdX has released a post mortem report regarding a targeted assault on its v3 platform which occurred this past November that also resulted in a $9 million loss from its insurance fund, constituting approximately 40% of the total fund.

The post revealed that the attacker, whose identity has since been uncovered, engaged in extensive 5x leveraged long positions in USD across over 100 wallets. The native token for DeFi protocol Yearn Finance, YFI, experienced a 215% surge in price as the attacker, utilizing various addresses, acquired spot YFI tokens.

What Happened

The assailant leveraged their unrealized profits to establish additional YFI-USD positions, peaking at approximately $50 million. On November 17th, 2023, dYdX responded by reducing the base and incremental position sizes to constrain the attacker. The subsequent day witnessed a nearly 30% plunge in the price of YFI within an hour, yet the attacker failed to close their positions. As their holdings turned negative, the insurance fund automatically offset their losses.

Notably, a week before the YFI incident, the attacker executed a similar strategy targeting USD, withdrawing about $5 million in profits. However, this did not impact the v3 insurance fund, as dYdX had raised the initial margin requirement to 100%, preventing further earnings for the attacker.

Damage Control

The exchange has assured that customer funds remained unaffected and suggested the attacker did not profit from manipulating the YFI market. In response to potential future attacks using similar tactics, dYdX announced enhancements to the v3 trading platform, emphasizing improved open-interest monitoring and alerting capabilities.

Moreover, the forthcoming v4 chain is designed to mitigate risks like those witnessed in this incident. The upgrade incorporates a new software feature automatically adjusting the initial margin fraction in the event of abnormal price movements. As of now, the company has not responded to any requests for additional comments.