Pando Hack

Reported loss $18.6M
Mixin
Access Control

What happened

Pando Rings was exploited through manipulation of the sBTC-WBTC liquidity-provider token price used by its oracle. Assets left the attacker's Mixin wallets before intervention. Pando and its partners froze other funds and halted affected services.

Technical root cause

Pando Rings relied on a manipulable LP-token price in its oracle. The official notice establishes this pricing failure but does not explain the underlying contract implementation.

How it happened

  1. The attacker manipulated the price of the 4swap LP token used by Pando Rings.
  2. The distorted oracle valuation enabled extraction of assets from the lending system.
  3. Some assets were transferred out before intervention; other assets were frozen with help from Mixin and the community.
  4. Pando halted services, began repairing the oracle and engaged SlowMist to trace funds.

Protocol details

Classification Exchange (DEX) / Ecosystem / Oracle Manipulation
Protocol Type Lending
Implementation language Go
Protocol links Website @pando_im

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes