Rho Markets Hack
What happened
Rho Markets on Scroll incurred about $7.6 million in bad debt after an ETH oracle was mistakenly configured to use a BTC price feed. An MEV bot detected the mispricing, borrowed against ETH collateral valued near twenty times too high, and later returned the funds.
A deployment and initialization error configured the ETH oracle to the BTC feed. The price-oracle setter worked as designed, but the configuration violated the collateral-pricing invariant and lacked a deployment-time validation safeguard.
How it happened
A deployment misconfiguration made ETH collateral use the WBTC/USD price feed. The MEV bot minted about 84 rETH as collateral, borrowed roughly 942 wstETH, swapped it to ETH, and repeated while ETH was dramatically overvalued.
The protocol paused vulnerable components and coordinated with SEAL 911. The operator contacted Rho and returned the funds, which Rho said would be reassigned to borrowing pools.
Protocol details
Funds Recovery
Recovered
$7.6M
Net Loss
$0
Evidence
- report @DLNewsInfo incident report x.com
- report @RhoMarketsHQ incident report x.com
- transaction Rho Markets Oracle Configuration Transaction app.blocksec.com
- analysis DeFiLlama defillama.com
- analysis Rho Markets Incident dedaub.com
- analysis BlockSec Oracle Monitor Incident Analysis blocksec.com
- analysis Rho Markets Recovers $7.6 Million decrypt.co
- analysis Rho Markets Protocol Profile defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
