DeltaPrime (November 2024) hack — November 2024

DeltaPrime is a leveraged borrowing protocol whose Prime Accounts let users borrow against deposited collateral. On 11 November 2024 an attacker drained funds from its Avalanche and Arbitrum deployments. It was the protocol's second incident in two months, following a loss of roughly $6 million in September 2024.

DeltaPrime's own post-mortem attributes the November exploit to missing validation in the claimRewards path. The attacker flash-loaned about 14,230 WAVAX, deposited it as collateral, then borrowed 56,923 WAVAX inside the same account, which kept the position within solvency limits. They deployed a fake Trader Joe Liquidity Book pair and rewarder and called claimRewards with it. The fake rewarder simply wrapped native tokens back into WAVAX; the protocol measured the balance difference before and after the call, treated the borrowed and collateral funds as reward income, and sent them to the attacker, who then repaid the flash loan. Three Sigma's independent analysis describes a second unvalidated parameter, an unchecked repay amount in swapDebtParaSwap, used to move borrowed assets out without settling the debt.

Figures differ. DeltaPrime's post-mortem states $4.75 million, Three Sigma calculates about $4.85 million and Halborn reports about $4.8 million.

The attacker moved proceeds into Trader Joe and Stargate pools on Avalanche within minutes and bridged part to Ethereum the same morning. On 18 November they claimed to be a white hat but returned nothing. DeltaPrime paused the protocol, added a 24-hour withdrawal queue and a solvency check on every Prime Account interaction, commissioned a BlockSec review, and proposed reimbursement tokens redeemable against a third of future protocol revenue.