dYdX v3 hack — November 2023

On 18 November 2023 dYdX drew more than $9 million from the insurance fund backing its v3 perpetuals exchange to cover shortfalls left by liquidations in the YFI-USD market. That was roughly 40 per cent of the fund, which held about $13.5 million afterwards. Founder Antonio Juliano called it a targeted attack on dYdX, and the company later published a post-mortem setting out what it found.

According to that report, the attacker funded a set of dYdX v3 accounts — 132 were confirmed as connected — and opened 5x leveraged long positions while buying the underlying token on spot markets to push the index price up. The method was first used against SUSHI-USD in late October and early November, when SUSHI rose about 180 per cent from roughly $0.67 to $1.20 and the attacker withdrew unrealised profits as the position grew. dYdX raised the initial margin requirement on that market to 100 per cent and the insurance fund was not touched. The same approach was then applied to YFI-USD from 1 November. Open interest in that market went from $0.8 million to $67 million and YFI rose about 215 per cent, from around $6,500 to over $14,000. When the price fell back the positions were bankrupt and the fund covered the difference.

dYdX said the attacker withdrew approximately $27 million against roughly $16 million deposited, and that they "likely did not profit on dYdX v3 from the price crash of $YFI" itself. Customer funds were not affected. Nothing has been recovered and no charges have been reported.