What happened
On November 18, 2023, coordinated trader activity around YFI caused dYdX v3's insurance fund to absorb more than $9 million in losses. The attacker had accumulated leveraged YFI long positions, repeatedly withdrew unrealized gains, and the subsequent YFI price crash left positions unliquidatable until they were already in negative equity.
dYdX v3 allowed unrealized gains to count as account equity for margin calculations, so the attacker could repeatedly withdraw against a manipulated mark price and expand exposure through new wallets. Risk controls and liquidation liquidity for the low-liquidity YFI market did not constrain the buildup or close the positions before they reached negative equity.
Case & protocol details
Attack Timeline
The attacker used more than 100 linked wallets to build 5x YFI long exposure, likely bought YFI spot across venues to raise its price, and withdrew mark-to-market gains to fund new positions. dYdX raised margin requirements and restricted position sizes, but YFI then fell nearly 30% in about an hour.
With insufficient liquidity to close or liquidate the oversized longs before bankruptcy, the protocol's insurance fund automatically covered the deficit. This was an insurance-fund loss, not a user-fund loss. The related SUSHI activity was part of the same actor's precursor strategy, not a second $9 million dYdX incident.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.