Cypher Protocol hack — August 2023

Cypher was a decentralised derivatives and margin-trading protocol on Solana. On 7 August 2023 an attacker withdrew far more than had been deposited, leaving the protocol with bad debt. The team froze the smart contract within hours and posted publicly that it had suffered an exploit, was investigating, and was willing to talk to the attacker about next steps.

The root cause lay in Cypher's isolated-margin sub-account mechanism. Halborn's analysis describes an error when an account switched to an isolated state that left the master account unaware of the change, so sub-accounts were not properly isolated from cross-collateralisation, together with margin-validation flaws and inactive oracle price feeds that permitted unauthorised borrowing. An account could then withdraw against collateral it did not have.

Most published estimates cluster near $1.03 million to $1.04 million. Beosin and DeDotFi, which analysed the transactions, put the take at roughly 38,350 to 38,530 SOL plus 123,184 USDC, and DailyCoin reported a total of $1,035,203. One outlet, CoinPaper, gave a materially higher total of about $1.9 million, itemised as 15,452 SOL, 14,675.34 jSOL, 8,749.91 mSOL, 0.99 wETH and 149,205.11 USDC; its SOL-family figures sum to roughly the same token count others report, which suggests the discrepancy lies in valuation rather than in the assets taken. The record carries the full range for that reason. Cypher's total value locked fell from about $1.2 million to roughly $510,000. Beosin traced the attacker's initial funding to accounts at KuCoin and Binance.

Cypher offered a $120,000 bounty, ten per cent of the take, and with the on-chain investigators ZachXBT and 0xGroomLake and several Solana firms froze about $600,000 at centralised exchanges. It opened a redemption process valuing claims at roughly $0.31 per dollar lost. The attacker was never publicly identified.

In May 2024 a Cypher contributor known as Hoak admitted taking about $260,000 from the project's redemption contract across 36 transactions and gambling it away, attributing it to a gambling addiction. That was a separate theft from the recovered funds, not part of the August 2023 exploit and not an admission of involvement in it.