DeltaPrime hack — September 2024

DeltaPrime, a lending and leveraged-trading protocol, lost close to $6 million from its Arbitrum deployment on 16 September 2024.

The attacker did not exploit a contract flaw. They obtained the private key of the externally owned account that still held admin rights over DeltaPrime's DepositIndex proxy contracts - wallets the team later said had never been moved to a multisig after deployment. Using that key they upgraded the proxies to their own implementation, which let them mint deposit receipt tokens in absurd quantities and redeem them against the savings pools. Merkle Science recorded receipt-token balances above 1.1e69 and traced the drained USDC, WBTC, WETH, ARB and DAI being swapped into 2,588 ETH, worth about $6.04 million, then split between two addresses, with 1,337 ETH bridged via Stargate and sent to Tornado Cash.

DeltaPrime's own post-mortem puts the loss at $5.98 million; Merkle Science's flow-of-funds analysis totals $6.05 million. The Avalanche deployment was unaffected because its equivalent contracts used multisig wallets and cold storage.

Attribution is unsettled. Investigator ZachXBT said DeltaPrime had previously engaged North Korean developers and that he had warned the project earlier that year, but stated the link between that and the hack was unclear; the company said it had removed those workers. No formal attribution has been made and no charges have been brought.

None of the stolen funds were recovered. DeltaPrime published a reimbursement plan allocating $1.33 million from its stability pool, leaving $4.65 million of damage, and offered affected users 40% extra in rTKN claims - raising the stated obligation to about $6.5 million - to be paid from 33% of future protocol revenue. It was the protocol's second incident in two months, following a roughly $1 million loss in July 2024.