dYdX V3 Hack
What happened
On November 18, 2023, coordinated trader activity around YFI caused dYdX v3's insurance fund to absorb more than $9 million in losses. The attacker had accumulated leveraged YFI long positions, repeatedly withdrew unrealized gains, and the subsequent YFI price crash left positions unliquidatable until they were already in negative equity.
dYdX v3 allowed unrealized gains to count as account equity for margin calculations, so the attacker could repeatedly withdraw against a manipulated mark price and expand exposure through new wallets. Risk controls and liquidation liquidity for the low-liquidity YFI market did not constrain the buildup or close the positions before they reached negative equity.
How it happened
The attacker used more than 100 linked wallets to build 5x YFI long exposure, likely bought YFI spot across venues to raise its price, and withdrew mark-to-market gains to fund new positions. dYdX raised margin requirements and restricted position sizes, but YFI then fell nearly 30% in about an hour.
With insufficient liquidity to close or liquidate the oversized longs before bankruptcy, the protocol's insurance fund automatically covered the deficit. This was an insurance-fund loss, not a user-fund loss. The related SUSHI activity was part of the same actor's precursor strategy, not a second $9 million dYdX incident.
Protocol details
Evidence
- report @AntonioMJuliano incident report twitter.com
- report dYdX SUSHI and YFI Incident Post-Mortem dydx.exchange
- address Common Linked Funding Source etherscan.io
- analysis DeFiLlama defillama.com
- analysis dYdX v3 Targeted Attack Linked to YFI Price Manipulation blockworks.com
- analysis Slippage, Futures and the YFI Manipulation on dYdX decentralised.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
