Solana Derivatives Exchange Mango Suffers $100M+ Hack

Solana DeFi derivatives exchange Mango has suffered a $100 million exploit, involving the manipulation of a price oracle. The hack is one of several in less than a week, just a matter of days after a similar amount was stolen from BNB Chain and two months after a major Solana wallets hack.

What exactly happened?

The Mango exploiter appears to have been able to manipulate the value of positions they opened on the platform, then withdrawn tokens from the platform against this inflated value.

The attacker began by depositing $5M USDC into Mango, then opened several long positions on the MNGO-PERP perpetual swap contracts for the platform’s native MNGO token. The attacker then ran up the price of MNGO on Mango and other crypto xchanges, from which Mango Markets obtains their price feed oracles for MNGO-PERP.

Using the artificially inflated value of their MNGO position, which was now in a massive profit, the attacker then proceeded to withdraw large sums of tokens from the Mango platform against the value of that position.

These withdrawals began with $50M of USDC, then continued several minutes later with subsequent withdrawals of $23.9M in SOL, $26.7M in MSOL, $5.4M in BTC, another $2.8M in USDC, $3.3M in USDT, $1.7M in SRM, and $14.8M in MNGO.

The response

Shortly after the exploit, the Mango team disabled deposits on the front-end user interface to prevent further losses to its users.

They are also looking to have third parties freeze stolen funds where possible, likely stablecoin companies Circle (USDC) and Tether (USDT).

Further, the team has appealed to the trader to reach out via email to discuss a possible bug bounty for the return of a majority of the funds.

The price of $MNGO has plummeted by more than 51% over the last 24 hours, following the news of the attack, according to data from CoinGecko.