Casey Wagner

Crypto trader Avraham Eisenberg was convicted on Thursday in relation to trades he made in October 2022 to extract more than $100 million from Mango Markets, according to a <a href="https://www.bloomberg.com/news/articles/2024-04-18/crypto-trader-convicted-in-110-million-haul-from-mango-markets?utm_campaign=socialflow-organic&amp;utm_source=twitter&amp;utm_medium=social&amp;utm_content=crypto">report</a> from Bloomberg.



28-year-old Eisenberg was charged with commodities fraud, wire fraud and commodities manipulation. The jury found him guilty of all three counts.



After closing arguments from the government and defense, the jury deliberated Wednesday afternoon and into Thursday before returning with their verdict. The trial lasted one week and took place just a few floors below where FTX founder Sam Bankman-Fried was sentenced last month.



Read more: <a href="https://blockworks.co/news/mango-markets-wants-eisenberg-to-pay">Mango Markets wants Eisenberg to pay up, his lawyers say the &#8216;matter was settled&#8217;</a>



Eisenberg was arrested in Puerto Rico in December 2022. Prosecutors say he illegally made off with $110 million after manipulating Mango Market futures contracts and pumping the price of swaps by 1,000%. He then borrowed against the contracts and boarded a flight from Puerto Rico to Israel. 



The government says he was fleeing because he committed a crime, but <a href="https://blockworks.co/tag/avraham-eisenberg">Eisenberg</a>’s defense team claims he was running after receiving numerous threats following his trades. 



“The more he pumped, the more he could steal,” government attorneys said Wednesday during their closing arguments. “It is clear as day the defendant knew” he was committing crimes, the prosecution added.&nbsp;



The defense’s case focused on the structure of decentralized exchange <a href="https://blockworks.co/tag/mango-markets">Mango Markets</a>, which, Eisenberg’s team says, allowed for the trades to take place. 



Read more: <a href="https://blockworks.co/news/avi-eisenberg-confined-to-jail">DeFi trader Avi Eisenberg is stuck in US custody. Here’s how he got there.</a>



Eisenberg employed a “successful, legal trading strategy,” defense attorney Brian Klein told the jury Wednesday.&nbsp;



His client was never asked to prove his identity, maintain collateral on the platform or complete a credit check, Klein said.&nbsp;



In the government’s rebuttal, assistant US attorney Thomas Burnett said that the defense was trying to distract from the government’s claims.&nbsp;



“The data and documents show he was borrowing. You should believe your own eyes,” he told the court.



This is a developing story.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Crypto trader convicted in $110M Mango Markets fraud trial: Bloomberg

David Canellis

Katherine Ross

Michael McSweeney

<h2 class="wp-block-heading">Decision time in Mango trial&nbsp;</h2>



Closing arguments in Avraham “Avi” Eisenberg’s criminal fraud trial wrapped yesterday. The jury was given the case around 3:30 pm ET and called it a night after an hour of deliberations. They will resume this morning and a verdict is expected this afternoon.&nbsp;



Prosecutors say the 28-year-old crypto trader illegally manipulated markets when he made off with $110 million in October 2022 following a series of trades on DeFi trading platform Mango Markets. Eisenberg has been charged with commodities fraud, commodities manipulation and wire fraud.&nbsp;



“The more he pumped, the more he could steal,” government attorneys said Wednesday during their closing arguments. “It is clear as day the defendant knew” he was committing crimes, the prosecution added.&nbsp;



His defense team said this week that it’s all a big misunderstanding. Eisenberg just made some good trades. Plus, he had $13 million on the line.&nbsp;



Read more: <a href="https://blockworks.co/news/avi-eisenberg-committed-fraud">Mango Markets exploiter Avi Eisenberg committed fraud, Feds say</a>



Eisenberg was arrested in Puerto Rico in December 2022. Prosecutors say he manipulated Mango Market futures contracts and pumped the price of swaps by 1,300%. He then borrowed against the contracts and boarded a flight from Puerto Rico to Israel.&nbsp;



The defense denies none of this; they just claim that it was all legal. It’s not Eisenberg’s fault he wasn’t required to submit personal information or that Mango didn’t run a credit check. That’s just how these wild crypto markets work, they said.&nbsp;



The government says he was fleeing because he committed a crime — his internet search history in the days and before and after the trades shows he was researching “fraud” and “statute of limitations on market manipulation” — but Eisenberg’s defense team claims he was running after receiving numerous threats following his trades.&nbsp;



Plus, defense attorney Brian Klein said yesterday, Eisenberg wouldn’t have continued to search these terms if he’d actually thought he did something wrong. I’d beg to differ, but maybe the jury feels differently.&nbsp;



“None of us want to be judged on our web searches,” Klein said. “None of us.”&nbsp;



Presiding Judge Arun Subramanian, one of the newer judges at SDNY — appointed in 2023 — is tasked with overseeing the landmark case. It’s the first time ever the question of whether someone manipulated crypto markets will be posed to a US jury.&nbsp;



There’s no question that lax <a href="https://blockworks.co/tag/kyc">KYC</a> rules aided Eisenberg in his trades. He executed some under the identity of a Ukrainian woman after buying her login information, the government says.&nbsp;



Also, before you get too excited about those “commodity” charges, the Department of Justice isn’t actually claiming MNGO is a commodity; they avoided classifying the token altogether. The DOJ did say that USDC is a commodity and the “perpetuals” in question are “swaps” to justify the charges, though.&nbsp;&nbsp;



The SEC’s case against Eisenberg, which is on hold until these criminal proceedings wrap, specifically calls MNGO a “crypto asset security” given its status as an “investment contract.”&nbsp;



The semantics around classification, at this point, are the least of Eisenberg’s worries, but it is something to watch out for if the <a href="https://blockworks.co/tag/sec">SEC</a> case proceeds. (If Eisenberg is found guilty of criminal charges, the civil suits might get dropped.)&nbsp;



Keep an eye on Crypto Twitter today. The jury was instructed to resume deliberations promptly at 9 am this morning. They’ve also been told they can work through lunch.&nbsp;



Subramanian, unlike Lewis Kaplan who oversaw SBF’s criminal trial, allows cell phones in the courtroom, so news when the verdict drops will travel fast.&nbsp;&nbsp;



— Casey Wagner



<h2 class="wp-block-heading">Data Center</h2>



<ul>
<li>Mango Markets has 94,000 SOL ($12.7 million) <a href="https://defillama.com/protocol/mango-markets#information">staked</a> in the app, most of it added months after the Eisenberg incident.</li>



<li>Growth in ETH supply <a href="https://www.validatorqueue.com/">staked</a> has slowed considerably since March, sitting around 26%.</li>



<li>Ethena’s USDe <a href="https://app.ethena.fi/dashboards/solvency">supply</a> has topped out at $2.37 billion for now, after rocketing from $200 million to $2 billion in two months.</li>



<li>Farcaster daily users are <a href="https://dune.com/pixelhack/farcaster">holding</a> strong at more than 40,000, down only around 15% since record highs.</li>



<li>Mantle’s on-chain <a href="https://defillama.com/treasuries">treasury</a> (excluding own tokens) is now almost as big as the Ethereum Foundation’s: $870 million to $933 million.</li>
</ul>



<h2 class="wp-block-heading">Rocky path ahead?</h2>



As someone who started her career reporting on Wall Street, I’m particularly intrigued by the upcoming <a href="https://blockworks.co/tag/bitcoin-halving">halving</a>.&nbsp;



Not just because it’s my first time getting to cover it through a crypto lens and not looking from the outside in, but also because of the way Wall Street and institutions are now interacting with crypto, specifically bitcoin.&nbsp;



With that said, let’s talk about the publicly traded miners. <a href="https://blockworks.co/tag/mining">Mining</a> as a whole is going to be vulnerable post-halving for obvious reasons, but we’ve <a href="https://blockworks.co/news/jpmorgan-bitcoin-halving-publicly-traded-miners">previously reported that Wall Street analysts</a> think that the publicly traded group could benefit from the quadrennial event. 



However, we’re just days out, and there’s a lot of red when looking at the miners as a group. Marathon’s down nearly 17% in the past five days, Riot’s shed 18%, Hut 8’s down 8%, though CleanSpark’s only down 3%.&nbsp;



Read more: <a href="https://blockworks.co/news/bitcoins-most-promising-least-dramatic-halving">Bitcoin’s most promising, least dramatic halving is almost here</a>



In total, the aggregate market cap dropped 28% as of April 15, according to data from JPMorgan. The market cap now sits at around $14.2 billion.



For some analysts on Wall Street, the question is simple: Is this a buying opportunity? For Bernstein analysts, it’s an opportunity to buy stocks such as Riot and CleanSpark.&nbsp;



As we’ve <a href="https://blockworks.co/news/bitcoin-halving-price-implications">reported previously</a>, it’s hard to know what’s going to happen post-halving for two reasons. First, this is only the fourth such event in Bitcoin’s history, so we don’t have a lot of historical data to use. Second, this is a totally different environment for Bitcoin than we’ve seen in the past.&nbsp;



Historically, yes, bitcoin’s gone on to carve out new all-time highs in the months post-halving, and there’s no reason to think it couldn’t hit six figures by the end of the year. Immediately after the event, bitcoin could undergo pressure dropping to the mid-$50,000 or even around $40,000.&nbsp;



And stocks of the bitcoin miners — <a href="https://blockworks.co/news/mining-firms-prepare-for-bitcoin-halving">despite their preparation</a> — could also face headwinds.



— Katherine Ross



<h2 class="wp-block-heading">Putting the Fi in GameFi</h2>



The metaverse may go the way of the enterprise blockchain — a forgotten fad — but GameFi is at least getting another run.



GameFi is a catch-all term for games with some sort of crypto or blockchain integration, through which players can collect and trade NFTs tied to in-game assets, including heroes and items.&nbsp;&nbsp;



While not the first, Vietnamese studio Sky Mavis largely popularized the NFT format with Axie Infinity. The game’s smart contracts are still some of the most active in the space.&nbsp;



Read more: <a href="https://blockworks.co/news/sui-playtron-handheld-web3-gaming-device">Web3 Watch: Sui unveils handheld Web3 gaming device</a>



Business and farming simulators, card battle games and tower defense apps are also common across the major gaming ecosystems with their own layer-1s: Sky Mavis’ Ronin and Gala Games’ Gala Smart Chain, as well as Merit Circle’s Avalanche subnet BEAM.



Ronin, however, is gathering its own on-chain economy. The network seems to have largely rebounded since the <a href="https://blockworks.co/news/the-ronin-hacker-made-off-with-625m-of-crypto-but-cashing-out-isnt-so-easy">debilitating $625 million raid</a> on its token bridge in early 2022. North Korea-linked hackers stole digital assets backing bridged tokens on Ronin, undermining in-game economies — particularly Axie Infinity’s — with the incident going unnoticed for six days.



Sky Mavis later moved to <a href="https://www.techinasia.com/sky-mavis-scales-150m-funding-reimbursing-users">make</a> users whole. At the time of the heist, monthly active addresses on Ronin had already fallen to 2.9 million from a peak of 5.9 million in peak bull market, in November 2021. Active addresses would drop another 65% over the next three months, and by last October, Ronin was seeing only 100,000 monthly active addresses.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-us.googleusercontent.com/QzWqueflqFP4i-P8VCDPRzYo7cVSKn5EQ4aAFbFv9Q-371QjGApmK6n9Q39AR7d5gjCMhxvpvl0eOjUg4Esw5QQ5qeO04hFvGRav3Q75SrYMl70SGnpoa76jtYkdTfNCn4TqaxqvdDPTfQBe38nOu8c" alt=""/></figure>



Now, there&#8217;s 3.2 million, <a href="https://tokenterminal.com/terminal/projects/ronin">per</a> Token Terminal, and while it’s difficult to say how many represent unique individuals, it’s hard to argue with that growth. The number of transactions on the network hit 51.4 million last month, its highest point since the top of the last bull market.&nbsp;



Axie-related smart contracts are still driving much of the activity, but there are now five other games interacting with Ronin, including Pixels, and eventually a card battle game set in the popular Ragnarok universe. There’s also an NFT marketplace (Mavis Market) native to the network, and a budding decentralized exchange (Katana) is seeing anywhere from $60 million <a href="https://katana-analytics.roninchain.com/home">volume</a> to $4 million per day this year.



You wouldn’t think so, but Ronin is currently the ninth on monthly active user leaderboards, only just behind Uniswap and Base and ahead of TON, Optimism and Aptos.&nbsp;



— David Canellis



<h2 class="wp-block-heading">The Works</h2>



<ul>
<li>WorldCoin plans to <a href="https://blockworks.co/news/worldcoin-teases-world-chain-layer-2">launch its own layer-2</a>, dubbed World Chain, this summer.&nbsp;</li>



<li>Ivy League college students are dropping out to launch their crypto careers, Bloomberg <a href="https://www.bloomberg.com/news/articles/2024-04-17/how-to-get-a-job-in-crypto-bitcoin-price-spike-draws-young-startup-founders?utm_content=business&amp;utm_medium=social&amp;cmpid=socialflow-twitter-business&amp;utm_campaign=socialflow-organic&amp;utm_source=twitter">reports</a>.</li>



<li>This halving could be the least dramatic one yet, according to <a href="https://blockworks.co/news/bitcoins-most-promising-least-dramatic-halving">on-chain activity</a>.</li>



<li>TSMC expects a Q2 sales bump thanks to major demand for AI chips, Reuters <a href="https://www.reuters.com/technology/tsmc-set-report-5-rise-first-quarter-profit-strong-ai-chip-demand-2024-04-18/">reports</a>.&nbsp;</li>



<li>Binance received a full crypto license from Dubai after former CEO Changpeng Zhao forfeited voting control, Bloomberg <a href="https://www.bloomberg.com/news/articles/2024-04-18/binance-close-to-getting-dubai-vasp-license-after-cz-deal-bnb?utm_campaign=socialflow-organic&amp;utm_source=twitter&amp;utm_medium=social&amp;utm_content=crypto">reports</a>.</li>
</ul>



<h2 class="wp-block-heading">The Morning Riff</h2>



What does crypto sound like?



If Hans Zimmer’s <a href="https://www.youtube.com/watch?v=WNRGQMdd9gU">new</a> “theme” for Tron is any indication, it’s a three-minute soundtrack clip from a forgettable Michael Bay movie. Or some vaguely sci-fi video game intro screen. Here’s my review: meh.&nbsp;



It’s not Zimmer’s best work by any means —&nbsp;that obviously is the Interstellar score —&nbsp;but the song, announced yesterday by Tron’s Justin Sun, certainly achieves the goal of creating an association between crypto and an independently noteworthy source.&nbsp;



In this case, an Oscar-winning composer. Or at least his studio, which, <a href="https://www.vanityfair.com/hollywood/2022/02/the-ugly-truth-of-how-movie-scores-are-made">according</a> to Vanity Fair, employs dozens of so-called “Zimlings” to operate a compositional megafactory.&nbsp;



You gotta wonder how much TRX was shoveled into the great crypto furnace to pay for this one. One assumes Zimmer’s music-writing empire was fed dollars instead of crypto, but who knows?&nbsp;



Either way, I wouldn’t put this one in your Spotify inspiration playlist.



— Michael McSweeney



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Empire Newsletter: Decision time in Mango Markets trial

Shalini Nagarajan

Crypto-related hacks took a nosedive in the first quarter this year, new data from TRM Labs showed.



In a striking decline, about $400 million was pilfered in nearly 40 incidents, marking a 70% drop compared to the corresponding period in 2022.



A <a href="https://www.trmlabs.com/post/crypto-hacks-down-70-in-q1-2023" target="_blank" rel="noreferrer noopener">report</a> published on May 22 revealed that the average size of hacks dropped to $10.5 million from nearly $30 million in the same quarter a year ago. Meanwhile, hacking victims successfully recouped over half of the stolen funds during this period.



For instance, in March, a hacker discovered a <a href="https://tenderfi.medium.com/march-7-postmortem-170373e93cd1" target="_blank" rel="noreferrer noopener">bug in DeFi protocol Tender.fi&#8217;s code</a> and managed to snatch $1.5 million. But instead of running away with the loot, the hacker actually reached out to Tender.fi and struck a deal to return the money. The catch was a bug bounty worth 62.15 ether ($850,000)



TRM Labs said there is no single straightforward explanation for the decline in hacks, but two events may have dampened the enthusiasm of potential attackers.



In 2022, the top ten hacks reportedly accounted for about 75% of the total stolen funds. It’s important to note that quarterly numbers don&#8217;t accurately predict yearly losses.



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1496" height="1285" src="https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=1024&amp;h=1024" alt="" class="wp-image-56814" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=1496 1496w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=299 299w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=304 304w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=255 255w, https://blockworks-co.imgix.net/wp-content/uploads/2023/05/trm-chart.jpg?w=80 80w" sizes="(max-width: 1496px) 100vw, 1496px" /><figcaption class="wp-element-caption">Source: TRM Labs</figcaption></figure>



<h2 class="wp-block-heading">Eisenberg’s arrest in Mango Markets exploit</h2>



Crypto investor Avraham Eisenberg, who employed a &#8220;highly profitable trading strategy&#8221; to <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m">siphon off over $110 million</a> worth of crypto from DeFi trading platform Mango Markets, was arrested in Puerto Rico in Dec. 2022.



Shortly after the incident occurred in mid-October, the self-proclaimed game theorist <a href="https://twitter.com/avi_eisen/status/1581326197241180160" target="_blank" rel="noreferrer noopener">openly admitted</a> to his role in depleting Mango Markets&#8217; funds.



Despite Eisenberg returning a portion of the funds, apparently in exchange for avoiding legal repercussions, the SEC didn&#8217;t let him off the hook. The agency <a href="https://www.sec.gov/news/press-release/2023-13" target="_blank" rel="noreferrer noopener">charged</a> him with breaking anti-fraud and market manipulation rules in securities laws.&nbsp;



On top of that, Mango Markets didn&#8217;t hold back either and <a href="https://blockworks.co/news/mango-markets-wants-eisenberg-to-pay">slapped Eisenberg with a lawsuit</a>, demanding $47 million in damages plus interest.



“Avraham’s prosecution may have signaled to would-be attackers that even an agreement from the victim not to pursue legal action may not confer protection,” TRM Labs said.



<h2 class="wp-block-heading">US Treasury’s sanctions against crypto mixer Tornado Cash</h2>



Decentralized crypto mixer Tornado Cash was <a href="https://blockworks.co/news/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash">added to the US Treasury’s blocked list</a> last year. It was accused of facilitating the laundering of billions of dollars in virtual currency, including $455 million reportedly stolen by North Korean hackers.&nbsp;



As a consequence, the Treasury froze Tornado Cash&#8217;s US assets and prohibited American companies and individuals from conducting any business with them.



“The use of sanctions by the US government against crypto targets may have raised the potential costs of carrying out such attacks and made it more difficult to launder the proceeds,” TRM said.



However, the blockchain intelligence company said while crypto hacks have slowed down, the trend may only be temporary.



&#8220;The amount stolen and number of incidents in the first quarter of 2023 mirrors that of the third quarter of 2022. That was followed by a record-setting number of hacks that turned 2022 into a record year,&#8221; TRM added.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Arrests and Sanctions Drove Lower Crypto Hacks in Q1

Chaos Labs, a risk management platform for DeFi protocols, raised $20 million in seed funding from industry heavyweights.



The round was led by Galaxy and PayPal Ventures, including participation from Coinbase, Uniswap, Lightspeed, Bessemer and angel investors Balaji Srinivasan and Naval Ravikant.



Chaos’ fundraising comes after a <a href="https://blockworks.co/news/the-nine-largest-crypto-hacks-in-2022">record year of crypto-related hacks</a>, including the <a href="https://blockworks.co/news/sky-mavis-ronin-network-bridge-exploited-for-over-600m">Ronin Bridge attack</a> and the <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m">Mango Markets exploit</a>. The New York-based startup says it was founded to solve such security issues and to secure protocols against vulnerabilities and market manipulation.



“As the world moves from the opacities of traditional finance to a more open DeFi system, financial risk management must advance accordingly,&#8221; CEO Omer Goldberg said in a statement.&nbsp;



“At Chaos Labs, we believe that every DeFi protocol must regularly conduct robust risk testing to verify and validate that their economic system is secure against hackers and unanticipated volatility.”



Chaos claims its risk suite can boost DeFi protocol security through preventative measures and monitoring tools. It provides teams with protocol-specific simulation models to test attack strategies and find their applicability and profitability. Clients also have the option to receive suggestions on certain tactics that can be implemented in response to a hack.



Goldberg recently <a href="https://fortune.com/crypto/2023/02/21/chaos-labs-omer-goldberg-20m-seed-funding-mango-markets/" target="_blank" rel="noreferrer noopener">claimed</a> that Chaos’ software could’ve prevented the Mango Markets hack, which drained the platform of $114 million. Chaos already counts some of the most recognized DeFi players among its clients including Aave, dYdX, Osmosis and Chainlink.



Goldberg himself ventured into the crypto space in 2012, getting his first payment in bitcoin for working as a contractor, per a recent company <a href="https://chaoslabs.xyz/posts/chaos-labs-story" target="_blank" rel="noreferrer noopener">blog</a>. Between 2018 and 2020, he left the industry and went on to work as a tech lead at the Massachusetts Institute of Technology, Facebook and Instagram.



“In early 2021, I left my engineering role at Instagram to focus full-time on building in DeFi. With DeFi summer&#8217;s innovation and wave of attractive yields, I saw an opportunity to actively provide liquidity through automated smart contracts. However, with optionality comes risk, and DeFi has much of that,” Goldberg said.



Chaos’ teams are based in New York and Tel Aviv, and are made up of engineers from ex-FAANG companies and former members of the Israeli military.



The funds most recently raised will be used to hire people across its business units, expand the platform’s offerings and build out its suite of risk and security products.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DeFi Exploit Protector Raises $20M Round Co-led by PayPal

Avraham “Avi” Eisenberg, exploiter of DeFi protocol Mango Markets, is looking to retain a portion of the cryptocurrency he managed to gain from manipulation of the price of the Mango token (MNGO).&nbsp;



Eisenberg’s attorneys filed a motion Wednesday opposing the protocol’s lawsuit that seeks $47 million in damages from Eisenberg whose self-proclaimed “profitable trading strategy” netted him tens of millions in October.



“Mango Labs never explains in the [Preliminary Injunction] Motion where it came up with the amount of $47 million,” the attorneys said in the <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.592995/gov.uscourts.nysd.592995.35.0.pdf" target="_blank" rel="noreferrer noopener">motion</a>, adding that the protocol waited more than three months after the events and after the “matter was settled.”



<a href="https://blockworks.co/tag/mango-markets" target="_blank" rel="noreferrer noopener">Mango Markets</a>, a Solana-based DeFi platform, was <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m">drained of over $100 million</a> in October. Mango said the hacker, Eisenberg, was able to drain funds via an oracle price manipulation. 



Eisenberg purportedly used two addresses to manipulate the price of MNGO — Mango’s native token and collateral asset — from $0.04 to a peak of $0.91. This allowed him to borrow heavily against the inflated MNGO collateral, to the tune of about $114 million.



He proposed, via the Mango DAO governance forum, to return a portion of the funds including Marinade-staked Solana (mSOL), native <a href="https://blockworks.co/price/sol" target="_blank" rel="noreferrer noopener">SOL</a> and the MNGO token, but claimed the rest as a bounty. But Eisenberg offered recompense of $67 million to <a href="https://blockworks.co/news/mango-dao-readies-42m-to-make-users-whole">make users whole</a> on the condition that Mango wouldn’t push for criminal charges. 



Mango DAO voters then agreed to a proposal that would allow Eisenberg to retain $47 million of the originally stolen amount, as long as he would return the remainder.



The new civil <a href="https://www.courtlistener.com/docket/66760250/1/mango-labs-llc-v-eisenberg/">lawsuit</a> implies the October vote was meaningless. Eisenberg’s lawyers disagree.



“Per the Settlement Agreement, Mr. Eisenberg transferred funds totaling approximately $67 million to Mango Markets,” his attorneys said. “Several weeks later, eligible Mango Markets’ members received reimbursement from the Mango Markets treasury.”



However, in its own lawsuit, Mango said Eisenberg schemed to protect his ill-gotten gains by forcing the protocol “under duress” to a settlement agreement.&nbsp;



Eisenberg’s attorneys argue the only explanation for the “improper three-month delay” is that Mango is attempting to take advantage of Eisenberg’s arrest.



He was arrested in Puerto Rico in December, after which <a href="https://blockworks.co/news/avi-eisenberg-committed-fraud">US prosecutors charged Eisenberg with commodities fraud</a> and market manipulation.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Mango Markets Wants Eisenberg To Pay Up, His Lawyers Say the “Matter Was Settled”

Ben Strack

In the latest twist in the case against Avraham “Avi” Eisenberg, the CFTC has charged the former star DeFi trader.



Legal actions against Eisenberg, who, by his own admission, participated in an attack on DeFi exchange Mango Markets, are piling up.&nbsp;



Eisenberg was <a href="https://blockworks.co/news/avi-eisenberg-committed-fraud">charged</a> with commodities fraud and market manipulation by US prosecutors from the Southern District of New York last month. He was arrested in Puerto Rico on Dec. 26.



Now, the CFTC is going after civil monetary penalties and related relief, which could include trading bans, restitution, disgorgement and rescission, as well as pre- and post-judgment interest, according to a complaint <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.592057/gov.uscourts.nysd.592057.1.0_1.pdf" target="_blank" rel="noreferrer noopener">filed</a> Monday.



Eisenberg engaged in “a manipulative and deceptive scheme” leading to the misappropriation of more than $100 million from the platform, according to the complaint.



“The goal of [the] defendant’s scheme was straightforward: to artificially inflate the value of his swap contract holdings on Mango Markets through price manipulation, so that he could borrow’ a significant amount of digital assets that he had no intention to repay,” CFTC lawyers said in the complaint.



The <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m">attack</a> on the Solana-based trading platform dates back to October. The exchange said at the time that the hacker was able to drain funds from its platform using a technique known as <a href="https://coinmarketcap.com/alexandria/glossary/oracle-manipulation" target="_blank" rel="noreferrer noopener">oracle price manipulation</a>.



The exploit sent the price of Mango’s native token MNGO <a href="https://blockworks.co/news/mango-markets-exploit-plot-revealed">plummeting</a> by about 50%. A <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/2NGgwYnh5rV4igUwr4sBaeRCTzkyyJ64habEaPraRWZx" target="_blank" rel="noreferrer noopener">proposal to transfe</a><a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/GYhczJdNZAhG24dkkymWE9SUZv8xC4g8s9U8VF5Yprne">r</a> $42 million USDC to cover reimbursements for users was <a href="https://blockworks.co/news/mango-dao-readies-42m-to-make-users-whole">later passed</a> by Mango governance.&nbsp;



Eisenberg said in a series of <a href="https://twitter.com/avi_eisen/status/1581326197241180160" target="_blank" rel="noreferrer noopener">tweets</a> on Oct. 15 that he and his team used the protocol “as designed” — and believed their actions to be legal.&nbsp;



He could not immediately be reached for comment.&nbsp;



Ian Corp, an attorney with law firm Agentis, previously told Blockworks that the SEC and CFTC would have to prove Mango token was either a security or commodity to bring charges against Eisenberg.



The CFTC labels bitcoin, ether and tether as commodities in the legal document, alleging that Eisenberg used the artificially inflated value of his MNGO-USDC swaps to withdraw those commodities and other digital assets.



A court document <a href="https://blockworks.co/news/avi-eisenberg-confined-to-jail">issued</a> last week is set to keep Eisenberg behind bars under the custody of the US Attorney General.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Avi Eisenberg Faces More Charges — This Time From the CFTC

Sebastian Sinclair

Once high-flying crypto trader Avraham “Avi” Eisenberg has been confined to a Puerto Rican jail for the foreseeable future — capping off a rapid fall to what by most appearances had been a remarkable rise.&nbsp;



US prosecutors have deemed Eisenberg responsible for financial fraud and market manipulation in relation to an October 2022 <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m">attack</a> on Mango Markets, a DeFi trading platform built on the Solana blockchain. It resulted in an initial loss of at least $112 million of cryptoassets.&nbsp;



Digital asset traders have been keeping a close eye on the case, especially considering Mango’s native token (<a href="https://blockworks.co/price/mngo">MNGO</a>) has plummeted some 48% since the exploit. It’s now trading around two cents. Still, MNGO bulls have toured the resilience of the token, especially in the aftermath of FTX’s collapse that sent virtually all cryptocurrencies reeling.&nbsp;



That, coupled with other macro forces, has likewise applied downward pressure to MNGO, plus other <a href="https://blockworks.co/category/defi">DeFi</a> assets — in addition to Eisenberg’s alleged misconduct.



Here’s a look at how Eisenberg got here via a timeline of consequential events outlining his attempts to reverse his “highly profitable trading strategy” — and how he wound up in the crosshairs of US prosecutors.&nbsp;



<h3 class="wp-block-heading">New court documents dubs Eisenberg flight risk&nbsp;</h3>



A <a href="https://www.courtlistener.com/docket/66685181/8/united-states-v-eisenberg/" target="_blank" rel="noreferrer noopener">court document</a> issued Wednesday signed off on by the judge overseeing the case grants prosecutors’ request to keep Eisenberg behind bars, where he’s set to remain under the custody of the US Attorney General.&nbsp;



Their rationale: he’s subject to a lengthy incarceration if convicted and has significant family ties outside the US.



US Magistrate Bruce J. McGiverin, who issued the order, agreed with prosecutors in saying the reasoning behind Eisenberg’s continued custody is strongly tied to upwards of $40 million of outstanding digital assets. The missing funds, plus his dual citizenship, offers both the means and motivation to flee the country, the order says.&nbsp;



<h3 class="wp-block-heading">Eisenberg ousts himself</h3>



The fast-developing case against the self-styled “game theorist” largely stems from the Mango manipulation last year.&nbsp;



Eisenberg later admits responsibility by orchestrating a complex attack that acted on the spot price of Mango’s token to drive up his own holdings. He then is said to have taken out lines of credit collateralized by that value — before exiting the protocol altogether.



Following the Oct. 12 exploit, Eisenberg comes forward a <a href="https://blockworks.co/news/mango-markets-exploit-plot-revealed">week later</a> claiming to be part of a group that drained Mango’s funds. On Twitter, Eisenberg attempts to justify their actions as “legal,” because they had used the protocol “as designed.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Statement on recent events: I was involved with a team that operated a highly profitable trading strategy last week.&mdash; Avraham Eisenberg (@avi_eisen) <a href="https://twitter.com/avi_eisen/status/1581326197241180160?ref_src=twsrc%5Etfw">October 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Of the $112 million taken, Eisenberg returns <a href="https://twitter.com/mangomarkets/status/1581351549644591104?s=20&amp;t=9Xyt2Cc97N9F0A3iOR0_MA" target="_blank" rel="noreferrer noopener">$67 million</a> in various digital assets, which is later voted on as a refund split by Mango’s decentralized autonomous organization.



<h3 class="wp-block-heading">Prosecutors come a-knockin’</h3>



Shortly after the holidays, Eisenberg is <a href="https://blockworks.co/news/avi-eisenberg-committed-fraud">charged</a> with commodities fraud and market manipulation by US prosecutors from the Southern District of New York and is arrested in Puerto Rico. In a Dec. 19 <a href="https://storage.courtlistener.com/recap/gov.uscourts.nysd.591629/gov.uscourts.nysd.591629.1.0.pdf" target="_blank" rel="noreferrer noopener">complaint</a>, prosecutors allege Eisenberg willfully and knowingly attempted to manipulate and defraud markets, enabling him to withdraw millions in multiple cryptocurrencies with no intention of returning them.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DeFi Trader Avi Eisenberg Is Stuck in US Custody. Here’s How He Got There.

Bessie Liu

Mango Markets attacker Avraham &#8220;Avi&#8221; Eisenberg has been charged with commodities fraud and market manipulation by US prosecutors from the Southern District of New York. He was arrested in Puerto Rico on Monday.



The complaint, which was made public on Tuesday, said Eisenberg willfully and knowingly attempted to manipulate and defraud markets, enabling him to withdraw millions in multiple cryptocurrencies with no intention of returning the stolen assets.



During the attack in October 2022, Eisenberg <a href="https://blockworks.co/news/mango-markets-mangled-by-oracle-manipulation-for-112m" target="_blank" rel="noreferrer noopener">drained $110 million from the Mango Markets exchange</a>, which the US Federal Prosecutor is now taking exception to, alleging that he manipulated the price of a commodity by taking both sides of the transaction.



At the time, Ian Corp, an attorney at the Agentis law firm, told Blockworks that “it’s possible that the SEC and/or CFTC bring civil charges against them, but they would have to also prove that the Mango token was either a security or commodity.” In the complaint, the Assistant US Attorney states that &#8220;Perpetuals are &#8216;swaps'&#8221; under the Commodity Exchange Act.



Eisenberg riled some observers when he declared his move &#8220;a highly profitable trading strategy&#8221; in a tweet at the time.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Statement on recent events: I was involved with a team that operated a highly profitable trading strategy last week.&mdash; Avraham Eisenberg (@avi_eisen) <a href="https://twitter.com/avi_eisen/status/1581326197241180160?ref_src=twsrc%5Etfw">October 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Mango Markets is a Solana based cryptocurrency trading platform, where Eisenberg used oracle price manipulation techniques to withdraw and estimated $53.7 million in USD Coin (USDC) and $3.2 million in tether (USDT) and SOL.&nbsp;



The attack sent the price of Mango’s native token MNGO <a href="https://blockworks.co/news/mango-markets-exploit-plot-revealed">plummeting </a>by 50% on the day to roughly $0.02, 95% below its all time high of $0.50 set in September 2021.&nbsp;



A <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/2NGgwYnh5rV4igUwr4sBaeRCTzkyyJ64habEaPraRWZx">proposal to transfe</a><a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/GYhczJdNZAhG24dkkymWE9SUZv8xC4g8s9U8VF5Yprne">r</a> $42 million USDC to cover re-imbursements for its users was l<a href="https://blockworks.co/news/mango-dao-readies-42m-to-make-users-whole">ater passed </a>by Mango governance.&nbsp;



Mango is not the only exploit attempted by Eisenberg.&nbsp;



The hacker had also left DeFi lending giant Aave, in $<a href="https://blockworks.co/news/aave-curve-bad-debt">1.7 million bad debt</a>.&nbsp;



At the time, Eisenberg accumulated an estimated 92 million in token loan of Curve Finance’s native token, CRV over a period of six days, then rather than paying back the loan, he allowed a total o<a href="https://blockworks.co/news/curve-stablecoin-crv-loan">f $63.6 million in USDC collateral to be liquidated.</a>



The price of Aave dipped as bad debt accrued, but recovered fully once liquidation was complete, it’s team confirmed that the deficit could easily be covered with the protocol’s treasury holdings. And the Aave community quickly&nbsp; implemented short-term action to prevent further exploits.&nbsp;



Eisenberg&#8217;s exploits have been hotly debated in the crypto community, but the pseudonymous &#8216;swapman&#8217;, a co-admin of Whalepool.io. said that even if Eisenberg’s actions are “justifiable, and morally acceptable. If the intent is clearly to steal, then it is unethical.”



Avraham Eisenberg did not immediately return a request for comment.



Updated Dec. 27, 2022 at 18:49 ET: Additional context throughout.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Mango Markets Exploiter Avi Eisenberg Committed Fraud, Feds Say

Macauley Peterson

<div id="highlights-block_6351a2b825351" class="highlights">
 <ul>
 <li>The wallet that drained Mango Markets has returned $67 million in tokens</li>
 <li>Avraham Eisenberg’s “highly profitable trading strategy” may not be a crime, but is it right?</li>
 </ul>
 
</div>



A <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/2NGgwYnh5rV4igUwr4sBaeRCTzkyyJ64habEaPraRWZx" target="_blank" rel="noreferrer noopener">proposal</a> to transfer $42 million in USD Coin (USDC) is set to pass Mango Markets governance unanimously, Thursday at around 5:00 pm ET.



The funds are earmarked to “make users whole” based on a <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/GYhczJdNZAhG24dkkymWE9SUZv8xC4g8s9U8VF5Yprne" target="_blank" rel="noreferrer noopener">proposal earlier this week</a> to deal with the protocol’s bad debt resulting from a price oracle exploit from earlier this month. That proposal called on the parties responsible to return millions of dollars in tokens.



Blockchain records show that the attacker followed through, with <a href="https://etherscan.io/tx/0x2587c1cfa8c07d5f50dad631dc75cf081f0e6f0233e60d136a7e9d4c2c6eaacd" target="_blank" rel="noreferrer noopener">10 million USDC</a> on Ethereum and <a href="https://solscan.io/account/yUJw9a2PyoqKkH47i4yEGf4WXomSHMiK7Lp29Xs2NqM#splTransfers" target="_blank" rel="noreferrer noopener">the rest on Solana</a> returned to Mango Markets’ control. The Mango Markets official Twitter account <a href="https://twitter.com/mangomarkets/status/1581351549644591104" target="_blank" rel="noreferrer noopener">confirmed</a> that “$67M in various crypto assets have been returned to the DAO.”



Mango Market’s CEO thanked Mango contributors for their efforts.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The program for depositors to recover funds is in audit and should be ready to go by tomorrow morning. Much thanks to all the Mango contributors working tirelessly to make this happen 🙏&mdash; daffy (@dadadadaffy) <a href="https://twitter.com/dadadadaffy/status/1582907587250397185?ref_src=twsrc%5Etfw">October 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



That leaves the group, <a href="https://cms.blockworks.co/mango-markets-exploit-plot-revealed/" target="_blank" rel="noreferrer noopener">fronted by Avraham Eisenberg</a>, with roughly $32 million, after you <a href="https://medium.com/@Austerity_Sucks/thoughts-on-110m-mango-markets-exploit-10e3d01ab0b5" target="_blank" rel="noreferrer noopener">factor in</a> the $10 million to execute the transactions needed for the price manipulation and $3 million used to buy spot MNGO — the Mango governance token whose price was manipulated.



Eisenberg declined to comment other than to link to <a href="https://twitter.com/avi_eisen/status/1581326197241180160" target="_blank" rel="noreferrer noopener">his previous statement</a>, calling the sequence of events a “highly profitable trading strategy.”



<h3 class="wp-block-heading">Differing views on the Mango Markets incident</h3>



The siphoning of $112 million from the Solana DeFi protocol has widely been called “<a href="https://twitter.com/Orlando_btc/status/1581349755422388224" target="_blank" rel="noreferrer noopener">market manipulation</a>,” but was it illegal? That may depend on the open question of whether MNGO is a security. The case is certain to be <a href="https://twitter.com/dkcrypto13/status/1581332281368940545" target="_blank" rel="noreferrer noopener">on the SEC’s radar</a>.



The attack can also be seen as an illustration of the natural outcome of an open permissionless system — one which, over time, is improved by such <a href="https://milkyeggs.com/?p=61" target="_blank" rel="noreferrer noopener">adversarial hardening</a>.



Blockworks Research Analyst Dan Smith has compared the incident to sandwich attacks — a <a href="https://cms.blockworks.co/flashbots-has-a-new-plan-make-tradfi-look-embarrassing/" target="_blank" rel="noreferrer noopener">form of maximum extractable value (MEV)</a> common in DeFi — and asks “how are sandwich attacks legal if Mango manipulation isn’t?”



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“In a sandwich attack, the attacker intentionally moves the market against the victim. They artificially affect the supply or demand of the asset,” Smith said.</blockquote>



Eisenberg claims all his groups’ actions were legal but notes that Mango Markets “unfortunately” became insolvent as a result, causing “users being unable to access their funds.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Unfortunately, the exchange this took place on, Mango Markets, became insolvent as a result, with the insurance fund being insufficient to cover all liquidations. This led to other users being unable to access their funds.&mdash; Avraham Eisenberg (@avi_eisen) <a href="https://twitter.com/avi_eisen/status/1581326202731913216?ref_src=twsrc%5Etfw">October 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



He stakes out a position on the moral high ground by returning the $67 million in tokens, characterizing the move as a negotiated settlement, “with the goal of making all users whole as soon as possible.”



Under this framing, “he simply spotted what amounted to a dollar bill that someone dropped on the ground, and deigned to stoop down to pick it up,” as a pseudonymous developer for the CrocSwap DEX <a href="https://milkyeggs.com/?p=61" target="_blank" rel="noreferrer noopener">put it</a>.



Venture investor Ari Paul of BlockTower Capital acknowledged this line of thinking has some sense, but he argued that Eisenberg’s “talent” could be better applied.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Regardless of the legality, I’ll offer a friendly suggestion. You have rare talent. If you spend that talent building instead of playing zero sum (or negative) games, you’ll have a lot more pride in what you’ve done with your life in a decade and two.&mdash; Ari Paul ⛓️ (@AriDavidPaul) <a href="https://twitter.com/AriDavidPaul/status/1581531271804559360?ref_src=twsrc%5Etfw">October 16, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Courts have yet to adequately grapple with the “code is law” mantra common to more libertarian-minded crypto advocates.



The parallels to <a href="https://cms.blockworks.co/canadian-15-8m-defi-theft-case-could-upend-code-is-law-convention/" target="_blank" rel="noreferrer noopener">the case of Index Finance</a> are not lost on <a href="https://twitter.com/functi0nZer0/" target="_blank" rel="noreferrer noopener">Laurence Day</a>, a contributor to that protocol and plaintiff in the Canadian lawsuit against the alleged perpetrator of market manipulation that caused its downfall in October 2021.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Anyone affected with bad debt can file independently (as we’ve seen)&mdash; laurence (@functi0nZer0) <a href="https://twitter.com/functi0nZer0/status/1580956447046631437?ref_src=twsrc%5Etfw">October 14, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Day, who is now a student at the University of Leeds law school, tweeted that individuals have a right to seek redress in the courts for the injury caused by Mango Markets’ protocol debt, irrespective of any “settlement.”



<a href="https://twitter.com/functi0nZer0/status/1580996789217345536?s=20&amp;t=ZZWEUSHwEa-jeYIPU9tiCQ" target="_blank" rel="noreferrer noopener">Said Day</a>, the reimbursement by Eisenberg “doesn’t change the fact that but for the initial action there wouldn’t need to BE a paying off.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Mango DAO Readies $42M to ‘Make Users Whole’

<div id="highlights-block_634d1324a51bc" class="highlights">
 <ul>
 <li>Avraham Eisenberg, claiming to be part of the group that exploited Mango, said the protocol&#8217;s designed left it vulnerable</li>
 <li>The Mango team says it is in the process of recouping a portion of the funds, though no definitive timeline has been given</li>
 </ul>
 
</div>



A self-described “digital art dealer” claiming to be part of a group that siphoned $112 million from Mango Markets last week has come forward to defend the group’s actions.



In <a href="https://twitter.com/avi_eisen/status/1581326197241180160" target="_blank" rel="noreferrer noopener">a statement on Twitter</a>, Avraham Eisenberg said the group used the protocol “as designed,” believing their actions to be legal. The development team failed to anticipate the consequences of the protocol’s parameters, he said.



The attack <a href="https://cms.blockworks.co/mango-markets-mangled-by-oracle-manipulation-for-112m/" target="_blank" rel="noreferrer noopener">rocked the Solana-based trading platform</a> on Tuesday, sending the price of its native token, MNGO to roughly $0.02, down around 50% on the day, and off 95% from an all-time peak of $0.50 set in September 2021.&nbsp;



The wallet <a href="https://cms.blockworks.co/october-already-record-month-for-hacks-and-exploits/" target="_blank" rel="noreferrer noopener">receiving funds drained from the protocol</a> had proposed via a DAO community vote on Saturday to return a portion of the proceeds less a substantial bounty, if the community promised not to pursue legal action. That proposal was <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS" target="_blank" rel="noreferrer noopener">soundly defeated</a>.



Mango’s developers <a href="https://twitter.com/mangomarkets/status/1581351549644591104" target="_blank" rel="noreferrer noopener">tweeted</a> they are now in the process of recouping $67 million in various cryptoassets and said the team has started working on an algorithm to decide on a refund split.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We hopefully all agree that development speed should not sacrifice safety, hence there is no concrete timeline for when protocol users will regain access to their funds.&mdash; Mango (@mangomarkets) <a href="https://twitter.com/mangomarkets/status/1581351552341532672?ref_src=twsrc%5Etfw">October 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Eisenberg was initially linked to the wallet address that carried out the exploit via an ENS domain name <a href="https://app.ens.domains/name/ponzishorter.eth/details" target="_blank" rel="noreferrer noopener">ponzishorter.eth</a> and anonymous Discord chat messages <a href="https://karlstack.substack.com/p/exclusive-the-man-who-may-have-milked" target="_blank" rel="noreferrer noopener">published by Chris Brunet</a> that indicated the moniker was used by Eisenberg. The chat logs also showed Eisenberg discussing the precise mechanism of the exploit in advance.



<h3 class="wp-block-heading">Was the Mango Markets exploit a crime?</h3>



Since the attack, a debate has raged on crypto Twitter as to whether those responsible could be subject to civil or even criminal liability.



According to Doug Colkitt, founder of the Crocswap decentralized exchange, the group’s actions don&#8217;t rise to the level of “computer fraud.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ IMO settling with the Mango exploiter was the correct move. It&#39;s very unlikely the exploiter would have been criminally prosecuted, even if they were doxxed. To understand why, it&#39;s important to distinguish &quot;computer fraud&quot; from &quot;securities fraud&quot;.&mdash; Doug Colkitt (🐊,🐊) (@0xdoug) <a href="https://twitter.com/0xdoug/status/1580791924814123008?ref_src=twsrc%5Etfw">October 14, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Despite the significant funds removed from the protocol, legal prosecution is unlikely, according to Ian Corp, an attorney at law firm Agentis.



“It’s possible that the SEC and/or CFTC bring civil charges against them,” Corp told Blockworks via email, “but they would have to also prove that the Mango token was either a security or commodity.”



So far, there are few precedents for prosecuting this type of DeFi market manipulation.



“Celsius and Three Arrows engaged in obvious market manipulation and no government agency have come forward to punish them accordingly,” Corp said.



Blockworks Research analyst Dan Smith also drew a distinction between the facts in this case compared to other exploits.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“The exploiter only used open market operations to pull this off. No code was changed, no new code was deployed, and he did not have to manipulate anyone else into acting on his behalf,” Smith said.&nbsp;</blockquote>



But the case bears some similarities to <a href="https://cms.blockworks.co/canadian-15-8m-defi-theft-case-could-upend-code-is-law-convention/" target="_blank" rel="noreferrer noopener">the exploit that took down Indexed Finance</a> in December 2021. Founders of the protocol identified the attacker, and their resulting lawsuit is <a href="https://mcmillan.ca/insights/publications/defi-platform-mango-loses-117-million-in-smart-contract-exploit-are-daos-responsible-for-bad-smart-contracts/" target="_blank" rel="noreferrer noopener">pending in Canadian courts</a>.



A further proposal to deal with the DAO’s bad debt <a href="https://app.realms.today/dao/MNGO/proposal/GYhczJdNZAhG24dkkymWE9SUZv8xC4g8s9U8VF5Yprne" target="_blank" rel="noreferrer noopener">passed a community vote</a> and is expected to be discussed on Mango’s Discord on Monday.



Macauley Peterson contributed reporting.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Mango Markets Exploit Plot Revealed

Ornella Hernandez

<div id="highlights-block_63484ebbf8545" class="highlights">
 <ul>
 <li>Hackers have grossed $718 million so far during October, Chainalysis says</li>
 <li>At least four known exploits targeted DeFi protocols on Oct. 11 alone</li>
 </ul>
 
</div>



The culprit behind the <a href="https://cms.blockworks.co/mango-markets-mangled-by-oracle-manipulation-for-112m/" target="_blank" rel="noreferrer noopener">$112 million siphoned from Mango Markets</a>, a decentralized finance trading platform on the Solana blockchain, may have trouble cashing out.



The attacker manipulated the spot price of the Mango governance token (MNGO) on centralized exchanges, then used the inflated coins as collateral to borrow stablecoins, leaving the protocol with bad debt once the price of MNGO returned to Earth.



The exploiter then proposed to return a fraction of the funds via the platform&#8217;s governance system. In a curious twist, the exploiter’s address, it emerged, turned out to be <a href="https://explorer.solana.com/address/yUJw9a2PyoqKkH47i4yEGf4WXomSHMiK7Lp29Xs2NqM" target="_blank" rel="noreferrer noopener">the leading “yes” vote</a> for that proposal.



The ill-gotten stablecoins can be traced on the blockchain <a href="https://solscan.io/tx/5BxPxnby7tTrFnoy6LjpNTGxoUmBvFD3cAdUuozRdwESwxR8Vpj1Ph5t4wfYAh5Gjyx3hAN5PBXjbJtZ4Hw5qtg3" target="_blank" rel="noreferrer noopener">from Solana</a> to corresponding USD Coin (USDC) <a href="https://etherscan.io/tx/0xdd9cc9178e326c3678c49fac4aeab9deb4ed058dec0f907d5b8562f24c0f5c04" target="_blank" rel="noreferrer noopener">transfers on Ethereum</a>. The funds were then <a href="https://etherscan.io/tx/0xab6dca63908c69a2dc98394fc3559972e1150dd03fb4f2f957ad1f4d7899de7e" target="_blank" rel="noreferrer noopener">swapped</a> through a decentralized exchange to dai (DAI), which removed the risk of being frozen by USDC issuer Circle.



“Circle is investigating the incident in question and will take appropriate action,” a Circle spokesperson told Blockworks.



The Ethereum wallet that received the stolen funds now holds over $30 million in assets, including the ENS domain ponzishorter.eth. The wallet has <a href="https://debank.com/profile/0xadbab4f38ff9dcd71886f43b148bcad4a3081fb9/history" target="_blank" rel="noreferrer noopener">a long history</a> of NFT and DeFi-related transactions — unusual for a heist of this magnitude, where perpetrators tend to limit links to any potentially identifying information. That may aid law enforcement or exchange investigators seeking to link the address to a real person.



The incident revealed a weakness in Mango Markets’ price oracle, which FTX CEO Sam Bankman-Fried <a href="https://twitter.com/SBF_FTX/status/1580170248120324096" target="_blank" rel="noreferrer noopener">described</a> as a failure of risk management.



<h3 class="wp-block-heading">Four DeFi hacks in one day</h3>



The Mango Markets hack stood out for the large quantity of funds that was stolen. However, it was just one of four attacks on decentralized finance (DeFi) protocols that took place on Oct. 11. In total, approximately $115 million was stolen.



The <a href="https://cms.blockworks.co/templedao-loses-2-million-in-latest-exploit/" target="_blank" rel="noreferrer noopener">second-largest exploit targeted TempleDAO</a>, a yield-farming DeFi protocol, resulting in the loss of 1,831 ether, or $2.34 million at press time. 



Stax, a decentralized application powered by TempleDAO, <a href="https://twitter.com/staxfinance/status/1579855195693256704?s=20&amp;t=nibDhr9Xb0kQQ8PzALYKqA" target="_blank" rel="noreferrer noopener">tracked</a> the address of the actor responsible, and in the meantime, cautioned users against making further deposits into STAX contracts.



In third place, layer-1 blockchain QANplatform <a href="https://medium.com/qanplatform/qanx-bridge-wallet-disclosure-analysis-continuously-updated-724121bbbf9a" target="_blank" rel="noreferrer noopener">suffered</a> a bridge hack during which 1.4 billion QANX tokens, or just over $1 million, were drained from the QANX Bridge on both the Binance Smart Chain (BSC) and Ethereum.



The company stated that only the QANX Bridge smart contract deployer wallet was compromised — and that affected QANX token holders will be compensated.



The last target of Oct. 11 was Ethereum wallet service Rabby, which <a href="https://twitter.com/Rabby_io/status/1579819525494960128?s=20&amp;t=9YnaBr4LrW53AuOCjbkLuw" target="_blank" rel="noreferrer noopener">reported</a> an exploit in its smart contract for its Rabby Swap feature that resulted in an approximately $200,000 loss. It is still reportedly tracking the stolen funds.



These attacks all took place days after the <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">exploit of Binance’s BNB Chain that affected the BSC Token Hub</a> — the native cross-chain bridge between BNB Beacon Chain and BNB Smart Chain. The hacker successfully extracted around $100 million before being shut down.



BNB Chain is assessing next steps to upgrade and remedy the vulnerability.



“BNB Chain is less decentralized than Ethereum now, but more decentralized than many others. It will become more and more decentralized as our tech team continues to make progress,” <a href="https://www.bnbchain.org/en/blog/bnb-chain-a-decentralized-response/" target="_blank" rel="noreferrer noopener">according to</a> a BNB Chain blog post.



<h3 class="wp-block-heading">It’s been a rough year</h3>



The month of October — which is less than halfway through — has recorded the highest value hacked all year — $718 million across 11 different DeFi protocols so far, according to blockchain analytics unit Chainalysis.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ After four hacks yesterday, October is now the biggest month in the biggest year ever for hacking activity, with more than half the month still to go. So far this month, $718 million has been stolen from <a href="https://twitter.com/hashtag/DeFi?src=hash&amp;ref_src=twsrc%5Etfw">#DeFi</a> protocols across 11 different hacks. <a href="https://t.co/emz36f6gpK">pic.twitter.com/emz36f6gpK</a>&mdash; Chainalysis (@chainalysis) <a href="https://twitter.com/chainalysis/status/1580312145451180032?ref_src=twsrc%5Etfw">October 12, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The second-highest month was March, due to the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin network’s breach for roughly $625 million</a>, or 173,600 ether and 25.5 million USDC — the largest single hack to date. 



Chainalysis suggests that if this trend continues, 2022 will “likely surpass 2021 as the biggest year for hacking on record.”



Last year recorded over 200 hacks and more than $3 billion in losses. This year has already seen 125 hacks as it approaches the $3 billion threshold.



Cross-chain bridges appear to be a major target for hackers, accounting for 82% of losses this month and 64% of losses all year, according to Chainalysis data.



Youwei Yang, chief economist at bitcoin mining company BIT Mining Limited, told Blockworks that the technology behind cross-chain bridges “has to take some time to develop more thoroughly,” and attributes most problems to “the validators that are not that large of a group nor decentralized enough.”



He added that frequent hacks are “another reason why institutional investors — especially old money — are not fully ready to join the crypto force yet.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

October Already Record Month for Hacks and Exploits

<div id="highlights-block_634655ddb3f28" class="highlights">
 <ul>
 <li>Mango is currently investigating an exploit of the oracle price feeds for its own governance token</li>
 <li>The hacker responsible is asking DAO members to vote on a proposal that would return a portion of the stolen funds</li>
 </ul>
 
</div>



Mango Markets, a decentralized finance trading platform on the Solana blockchain, said Tuesday it was investigating a hack worth approximately $112 million in digital assets.



Mango said the hacker was able to drain funds from its platform utilizing a technique known as oracle price manipulation — a form of economic attack that has hit other DeFi protocols before.



The actor managed to withdraw various digital assets — mostly stablecoins, including $53.7 million in USD Coin (USDC) and $3.2 million in tether (USDT) — but also solana (SOL).



In an unusual twist, they’re <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS" target="_blank" rel="noreferrer noopener">proposing to return</a> a portion of the stolen funds, namely Marinade-staked solana (MSOL), native SOL and the platform’s own MNGO governance token. The rest the culprit claims as a “bounty.”



That is, of course, if Mango’s DAO community votes yes on the thief&#8217;s proposal.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“By voting for this proposal, mango token holders agree to pay this bounty and pay off the bad debt with the treasury, and waive any potential claims against accounts with bad debt, and will not pursue any criminal investigations or freezing of funds once the tokens are sent back as described above,” <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS" target="_blank" rel="noreferrer noopener">the attacker wrote</a> on the protocol’s governance forum.</blockquote>



The hacker is requesting Mango use its treasury stash of 70 million USDC to repay “bad debt.” This debt derives from an <a href="https://cms.blockworks.co/solana-lending-protocol-faces-governance-conundrum/" target="_blank" rel="noreferrer noopener">incident</a> in June when the Mango community <a href="https://twitter.com/dadadadaffy/status/1539219965492047874" target="_blank" rel="noreferrer noopener">teamed up</a> with another Solana-based lending and borrowing protocol, Solend, to deal with a systemic risk caused by a single large borrower, at risk of liquidation, that put the entire Solana DeFi ecosystem in jeopardy.



The Mango DAO, or stewards of the protocol, should also not pursue any criminal investigations or freeze the attacker’s funds — via centralized stablecoins such as USDC and USDT — once the cryptoassets are returned.



But not all the assets will be returned; while a definitive amount for the bounty was not given, it can be assumed from the tokens omitted from the initial hack that the attacker is requesting to keep well over half of what they stole — substantially more than most “white hat” hackers or <a href="https://cms.blockworks.co/?s=bounty" target="_blank" rel="noreferrer noopener">bug bounty hunters</a> typically receive.



Still, Mango DAO members have so far voted in favor of the hacker’s proposal, with a 99.9% &#8220;yes&#8221; rate from roughly 33 million MNGO tokens — although just a single wallet address is responsible for the lion’s share of the vote. As DAOs go, this one is extremely centralized, with most governance votes being decided by just a handful of addresses.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh4.googleusercontent.com/trU04t8jB7XWOD5WPANIn0V_WPQT9lauwb9qncu5j5DiqXFcACTG5GnxwVX3aFRxjwWcmRqTw-RJNNqsciFHU-Ycmi9pB30ehCiUrNjW1T8QOx2lWDsJ2FpZsuV601NVd5CGhPTavLBePiORAbewOcsAbqK2anQML0oV2M7H27yoxDpbwXPjOwkf3Q" alt="" width="800" height="276"/><figcaption>The top voters holding the bulk of MNGO tokens | Source: <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS/explore" target="_blank" rel="noreferrer noopener">Mango governance vote</a></figcaption></figure></div>


A further 67 million yes votes are required for the proposal to pass a quorum threshold during the three-day voting period.



<h3 class="wp-block-heading">Price oracle manipulation</h3>



While the consultation and investigation continue, the platform’s stewards have requested users to cease depositing assets until the situation becomes clearer.



Dapps such as Mango rely on oracles to pull on-chain data for specific tokens. Manipulation occurs when protocols such as data feeds are corrupted, allowing transactions that were not intended.



In the case of Mango, the attacker was able to manipulate their collateral value via the platform before taking out “massive loans” totaling $112,199,876 from Mango’s treasury, security auditing firm <a href="https://twitter.com/osec_io/status/1579969927020412929" target="_blank" rel="noreferrer noopener">OtterSec reported</a> on Twitter.



OtterSec founder Robert Chen confirmed the figure to Blockworks who said the price manipulation was suspected to have occurred on centralized exchanges which Mango used to reference the value of the collateral.



MNGO’s price briefly spiked about 300% to $0.15 in the space of 10 minutes on the FTX exchange, then dropped 88% to under $0.02 following the attack.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh3.googleusercontent.com/Ex0Qf7G_cCBVpkcvRInuxhu6D3qAr4Ujh6pQ5uwR_z0s6DxDKHHtistpPfC_lSxNUiHbLG26TMBk51UqyxFtY-glvT72k50Y4emXTJeVPLovBlZN5HHwiBkaWtMjmiHZJpi_SxABEv5w_bQ9b8Sb3L5q2u1yChE0dwG2926O21huIBRc2IJCzQ2mfg" alt="" width="800" height="500"/><figcaption>The MNGO/USD market on FTX, 1-minute time frame | Source: TradingView</figcaption></figure></div>


Solana developer Tom Geshury was credited with being the first to bring the hack to the security auditing firm’s attention.



Geshury told Blockworks the hacker used $10 million to self-trade Mango perpetual contracts and then an estimated $3 million to pump the price of MNGO and execute the plan, before market participants got wind of the scheme and began dumping their tokens.



Mango Markets is <a href="https://docs.mango.markets/tutorials/trading-on-mango" target="_blank" rel="noreferrer noopener">an interface to margin trade</a> on the Serum DEX, which is backed by the crypto arm of trading giant Jump Capital. Jump Crypto’s president Kanav Kariya also confirmed the mechanism at play in the exploit.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Jesus, the attacker pumped and dumped the mango token, which is a thinly traded token. Oracles just report the price. Pyth/Switchboard accurately reported the prevailing prices on exchanges&mdash; Kanav Kariya (@KanavKariya) <a href="https://twitter.com/KanavKariya/status/1579986625060573184?ref_src=twsrc%5Etfw">October 12, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Mango has released a <a href="https://twitter.com/mangomarkets/status/1579979342423396352?s=20&amp;t=UHiIdt-zGgX-qsdd8kfG6w" target="_blank" rel="noreferrer noopener">statement</a> saying it is taking steps to have third parties freeze funds in flight.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“We will be disabling deposits on the front end as a precaution and will keep you updated as the situation evolves,” the group <a href="https://twitter.com/mangomarkets/status/1579979342423396352" target="_blank" rel="noreferrer noopener">said via Twitter</a>.</blockquote>



Blockworks attempted to contact several admins on the Mango Discord channel but was unsuccessful.



A number of protocols have been hit by such attacks this year alone, including DeFi platform Inverse Finance for <a href="https://halborn.com/explained-the-inverse-finance-hack-june-2022/" target="_blank" rel="noreferrer noopener">$5.8 million</a> in June and stablecoin lending platform Fortress Protocol for <a href="https://www.stealthlabs.com/news/fortress-protocol-lost-usd-3-mn-in-oracle-price-manipulation-attack/" target="_blank" rel="noreferrer noopener">$3 million</a> in May.



The attack against Mango comes less than a week after Binance’s own network, BNB Chain, was targeted for <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">hundreds of millions of dollars</a> via a cross-chain bridge exploit. The amount stolen was <a href="https://www.bnbchain.org/en/blog/bnb-chain-a-decentralized-response/" target="_blank" rel="noreferrer noopener">contained to about $100 million</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.