What happened
On January 7, 2023, an arbitrage bot drained part of the Mycelium Liquidity Pool (MLP), the pool that takes the other side of trades on Mycelium Perpetual Swaps. MLP lost an estimated 4-6% of its value, reported at about $300,000.
Mycelium priced trades from several external exchange feeds. Two of them failed at once. Binance had blocked the US-linked IP address Mycelium used to query it, so that feed was offline. Mycelium said this was not widely communicated. Around 02:45 AEST, Bitfinex began publishing very volatile prices for ETH/USDT, and with Binance offline the platform leaned on Bitfinex and Coinbase data. Mycelium's ETH price moved away from the market and its spread became unusually wide. A bot spotted the gap and traded against MLP in large size until the team noticed.
Mycelium halted trading and ran an internal investigation. The pool was unavailable for about 2.5 hours in total. The team promised closer monitoring of price feeds, better alerts and faster communication.
How it happened
- Binance's API had blocked Mycelium's US-linked IP, taking one price source offline without the platform flagging it.
- At about 02:45 AEST on January 7, 2023, Bitfinex started publishing highly volatile ETH/USDT prices. With Binance missing, Mycelium relied on Bitfinex and Coinbase and could not correct the price against an independent feed.
- An arbitrage bot saw that Mycelium's ETH price and spread were out of line with the market and traded large size against MLP to capture the difference.
- MLP lost an estimated 4-6% before Mycelium suspended trading. The pool was unavailable for about 2.5 hours.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
