As a seasoned crypto investor with years of experience in this volatile market, I’ve seen my fair share of hacks and exploits. But the recent attack on Rho Markets left me shaken, especially when it was initially reported as an oracle issue that allowed an attacker to extract $7.6 million.


A bot, operated by an unidentified entity, gained access to $7.6 million from Rho Markets last week through an MEV (Maximum Extractable Value) attack on Scroll’s rollup chain. Initially, it was believed that a glitch in the oracle contract had enabled an intruder to make off with the funds. However, subsequent investigation revealed that this was actually the result of an MEV attack carried out by the bot, which took advantage of the reported oracle issue. The maliciously acquired funds have since been returned to Rho Markets’ liquidity and lending protocol on Scroll.

The attacker included a note in the on-chain record of the transaction that drained the funds, stating, “We acknowledge that these funds are rightfully yours. However, before we can facilitate their return, please concede that this was not an exploit or unauthorized intrusion, but rather a mistake on your part.”

During the past weekend, Rho Markets communicated via X that they had finished transferring all assets back into the protocol’s pools, indicating a successful completion of fund allocation. The post further stated, “The protocol is now operational once more.”

In a previous post, Rho Markets expressed their commitment to bolstering security protocols to avoid similar incidents in the future. Specifically, they plan to collaborate with additional third-party partners for heightened security. These partnerships will encompass on-chain data monitoring and smart contract audits. Moreover, internal security measures will be fortified through multiple reviews and stringent testing within a simulation environment prior to mainnet deployment.

After the attacker transferred the stolen funds back on the same day of the exploit, Rho Markets initiated steps to restart the protocol, which had been put on hold to prevent further losses. The plan involved several phases: first, refunding accounts that were targeted during the hack; second, replenishing depleted liquidity pools; and lastly, reactivating borrowing and transfer functions.

Last week proved to be particularly unnerving in the crypto world with two major incidents. L.I.Fi suffered from a $10 million exploit, while WazirX was hit by a hack resulting in over $230 million being stolen.

 

Read More

2024-07-23 17:37