- Over $100M is stolen by a hacker from Mango Markets.
- The Mango team blocked deposits soon after the exploit.
- The price of $MNGO has fallen more than 51% in the previous 24 hours.
Derivatives exchange in Solana Manipulating a pricing oracle resulted in a $100 million fraud on Mango. The hack comes a few days after a comparable amount was taken from BNB Chain, one of several in less than a week.
The attacker first deposited $5 million USDC into Mango, after which he placed a number of long positions on perpetual swap contracts known as MNGO-PERP for the platform’s native MNGO coin.
In order for Mango Markets to get their price feed oracles for MNGO-PERP, it appears that the attacker then drove up the price of MNGO on Mango and/or other exchanges.
The attacker then went on to take significant amounts of tokens from the network in relation to the value of their falsely inflated MNGO position, which was now making a huge profit.
$50 million in USDC was the initial withdrawal, followed a few minutes later by withdrawals of $23.9 million in SOL, $26.7 million in MSOL, $5.4 million in BTC, another $2.8 million in USDC, $3.3 million in USDT, $1.7 million in SRM, and $14.8 million in MNGO.
The Mango team blocked deposits on the front-end user interface soon after the exploit to stop future losses to its consumers.
We are currently investigating an incident where a hacker was able to drain funds from Mango via an oracle price manipulation.
— Mango (@mangomarkets) October 11, 2022
We are taking steps to have third parties freeze funds in flight. 1/
When feasible, they are also attempting to have third parties, most likely the stablecoin firm’s Circle (USDC) and Tether, freeze the stolen assets (USDT).
The company has also urged the trader to get in touch with them through email to explore the possibility of offering a bug reward in exchange for returning most of the money.
Following the revelation of the attack, the price of $MNGO has fallen more than 51% in the previous 24 hours, according to statistics from CoinGecko.
