In a striking reveal, decentralized exchange dYdX has identified the mastermind behind the November 17, 2023, attack on its v3 platform, which siphoned $9 million from its insurance fund. This breakthrough in cyber-sleuthing marks a pivotal moment in the exchange's fight against digital wrongdoing.
1/ After looking into the YFI incident on dYdX v3, we’ve successfully tracked down the individual responsible & made a report to law enforcement.
This is our in-depth analysis & next steps ??https://t.co/JGxebpERYl
— dYdX (@dYdX) January 3, 2024
Upgrading Security: A Step Ahead of Future Threats
Post-attack, dYdX isn't just sitting back. They're ramping up their defenses, enhancing their v3 trading platform with improved open-interest monitoring and alerts. This move is a direct counter to the sophisticated tactics used in the attack, ensuring better preparedness against similar threats in the future.
Attack Analysis: A Deep Dive into Devious Strategies
The attacker's method was nothing short of calculated brilliance. They opened numerous 5x leveraged long positions across over 100 wallets using the YFI/USD pair. By buying Yearn.finance tokens across different addresses, they triggered a staggering 215% surge in YFI's price. Their strategy peaked with unrealized profits hitting around $50 million.
But their fortune flipped on November 17, when dYdX tweaked the initial margin requirements and position sizes in the YFI/USD market. The very next day, YFI prices plummeted by nearly 30% within an hour, trapping the attacker in a position they couldn't exit. The resulting losses were covered by dYdX's insurance fund, but the attacker's holdings went negative.
Previous Profits and Future Precautions
Interestingly, this wasn't the attacker's first rodeo. A week prior, they employed the same strategy on SUSHI/USD, netting around $5 million. However, dYdX's proactive increase in initial margin requirement to 100% for SUSHI/USD prevented any impact on the v3 insurance fund from this earlier attack.
Client Funds Safe, Attacker's Gain Nil
Amidst the chaos, dYdX assures that no customer funds were affected, and the attacker didn't reap any benefits from manipulating the YFI market. The exchange is now contemplating legal action against the individual, sending a clear message to potential wrongdoers in the crypto world.
