Rho Markets Hit by $7.5M Hack, Attackers Demand Admission of Oracle Error for Fund Return

Rho Markets, a scroll-based money market, suffered an exploit that resulted in a loss of over $7.5 million. 

"We’ve detected unusual activity on our platform and are currently investigating it,” the team announced on its X account.

Exploit Mechanics

The attacker exploited a vulnerability in Rho Markets’ oracle system. Oracles are critical as they provide off-chain data to smart contracts. By manipulating the oracle, the hacker drained the protocol’s entire supply of USDT and USDC stablecoins. They withdrew more than double the posted collateral in Ether.

Blockchain security firm Cyvers initially suspected ‘Oracle access control by a malicious actor’ as the root cause. This was later confirmed by BlockSec, which noted a strange ownership transfer of the Oracle contract. On-chain detective ZachXBT suggested there was a high probability of fund recovery due to the attacker’s exposure to centralized exchanges.

Hacker's Demands

"Hello RHO team, our MEV bot have profited from your price oracle misconfiguration. We understand that the funds belong to the users and are willing to fully return. But first we would like you to admit that it was not an exploit or a hack, but a misconfiguration on your end. Also, please provide what are you going to do to prevent it from happening again.”

Recently, Rho Markets announced on Twitter that the incident has been resolved and funds will be reallocated back to borrow pools soon.