Mango Markets lost $100 million owing to an exploit in the second $100 million DeFi breach this week. Mango Markets reported on Twitter on Tuesday night that a hacker had used an oracle pricing manipulation to steal money from Mango. Just last Thursday, the Binance Smart Chain, another DeFi system, had $100 million stolen from it.
The attacker temporarily increased the value of their collateral, according to the blockchain auditing website OtterSec, and then drew out loans from the Mango treasury. Mango Markets is a Solana-based platform for spot margin and perpetual futures trading of digital assets on the Solana blockchain. Mango DAO is in charge of Mango Markets.
"The [MNGO] governance token was valued for far more than it should be," OtterSec's Robert Chen said. "With that, [the attacker] was able to take out large loans against it and then drain Mango's [liquidity] pools. It's like a lending-borrowing race: if you have overvalued collateral, you can then borrow against that collateral, and that's what they did."
Joshua Lim, the head of derivatives at Genesis Global Trading, tweeted, "At 6:19 PM ET, an attacker funded account A with 5mm USDC collateral." The attacker then offered 483 million units of MNGO perps (perpetual contracts) on the Mango Markets order book, as Lim said. The attacker then financed another account at 6:24 PM ET with 5 million USDC in collateral to purchase those 483 million MNGO perps at $0.03 each.
The attacker began manipulating the Mango spot market price at 6:26 PM ET, pushing the price to $0.91 and the 483 million MNGO's worth to $423 million. A loan of $116 million was then obtained by the attacker, leaving Mango's treasury with a negative balance of -116.7 million. USDC, MSOL, SOL, BTC, USDT, SRM, and MNGO were among the assets drained, completely eradicating Mango's liquidity.
As of publication, the drained funds were still there on the Solana blockchain. Offending addresses have been blacklisted in similar circumstances by centralized exchanges like Coinbase, Binance, and Kraken, the only organizations with the liquidity for someone to cash out amounts this high. Mango initially stated that it was "taking steps to have third parties freeze funds in flight" and "disabling deposits on the front end as a precaution."
On the Solana blockchain, Mango is a decentralized cryptocurrency exchange that lets users make loans and spot transactions. According to pricing statistics from CoinMarketCap, Mango's MNGO token has fallen over 42% in the last 24 hours due to concerns that the platform may have been abused.
