Crypto liquidity layer and lending protocol Rho Markets was exploited for $7.6 million. Bad actors took advantage of an Oracle contract deployed on the Scroll chain, allowing them to drain the amount in USDT and USDC stablecoins.
Blockchain security firm relayed the oracle attack through an X post, “@RhoMarketsHQ has announced that they have detected unusual activity on their platform on #Scroll chain and paused the platform! Root cause of this incident seems to be an oracle access control by a malicious actor! Affected pools are $USDC, $USDT. Currently, attacker holds $7.6M across multiple chains.”
Rho Markets notified its users of the hack, “We’ve detected unusual activity on our platform and are currently investigating it. During this time, we will be pausing the platform. Most of the pools are safe, so there is no need to worry.”
Scroll, an Ethereum layer 2 zk-rollup that Rho Markets operates over, chimed in, “Scroll was notified of a potential exploit within our ecosystem.” The rollup team delayed transaction finalization on the network to understand the nature and extent of the exploit and has brought finalization time back to normal. “We have confirmed that the exploit was application-specific. Currently, RhoMarket is leading the response efforts, and we can confirm that finalization is no longer delayed.”
On-chain sleuth ZachXBT provided their analysis of the situation, mentioning the event may not be as bad as imagined. “Exploiter has a ton of exposure to centralized exchanges so would say there’s a good probability this gets recovered and they are gray or white hat.” They posted again, “Good news everyone the exploiter sent this message on-chain,” with an image of the transaction and the message embedded in it by the hacker.
This week has been massive for hackers as two other high-profile hacks took over news coverage. WazirX was targeted by North Korean hackers and succumbed to losses of $230 million, marking one of the biggest attacks this year. LI.FI, in another hack, lost over $11 million as well.
