Worked example · 2023-08

Cypher Protocol sub-account isolation flaw — Solana — 2023-08-07

Loss: approximately $1M extracted from Cypher Protocol, a Solana-based perpetual-futures DEX whose margin / collateral accounting modelled trader exposure across isolated sub-accounts. The drain exploited a logic flaw in which the sub-account isolation invariants did not enforce a cross-account net-debt invariant, allowing the attacker to construct positions that were individually-solvent-per-sub-account but collectively-insolvent at the trader level.
Recovery: partial. Following the exploit, the attacker initially went silent; the Cypher team disclosed the incident and engaged on-chain forensics. Several weeks later, the attacker self-identified pseudonymously as "Hailey," a US college student, in a public statement claiming the funds had been "lost in a phishing scam" and that recovery was no longer possible. Approximately $300k was returned at various points; the remainder was retained. The attacker was subsequently arrested in January 2025 by US federal authorities, with the Department of Justice unsealing an indictment naming the individual. The case became one of the first US-prosecuted Solana-DEX exploit cases.
OAK Techniques observed: OAK-T9.004 (Smart-Contract Logic Flaw — invariant-enforcement / sub-account-isolation sub-class) — primary. The vulnerability was not a missing input-validation check (Cashio / Crema sub-class) nor an arithmetic-overflow (Cetus sub-class) but a logic-completeness failure: the protocol enforced an invariant per sub-account but failed to enforce the corresponding aggregate-level invariant that a trader's collected sub-account net debt could not exceed their collected sub-account net collateral. This is a distinct T9.004 sub-pattern from the Solana-side missing-account-validation cluster.
Attribution: pseudonymous The attacker was pseudonymous for several weeks post-incident, self-identified as "Hailey" in a public statement, and was subsequently identified, arrested, and indicted by US federal authorities in January 2025. The attribution arc — pseudonymous → self-identified → prosecuted — is unusual for Solana-ecosystem exploit cases and gives Cypher one of the cleanest US-jurisdictional prosecution records on the OAK v0.1 Solana cohort.
Key teaching point: sub-account isolation requires explicit cross-account aggregate invariants, not just per-account local invariants. Cypher's design isolated traders' exposure into multiple sub-accounts so that a loss in one sub-account would not cascade into others — a standard risk-isolation pattern. The protocol enforced solvency invariants per sub-account, but did not enforce that the trader (the natural-person actor controlling the sub-accounts) could not assemble a collection of sub-accounts that were individually solvent yet collectively withdrew more than was deposited. Defenders writing T9.004 mitigations for sub-accounted protocols should treat per-account invariants and cross-account aggregate invariants as separate proof obligations, both required.

Summary

Cypher Protocol was a perpetual-futures DEX on Solana with a margin-accounting design that allowed a trader to hold multiple isolated sub-accounts, each with its own collateral and positions, with the explicit risk-management goal that a liquidation in one sub-account would not affect the others. This is a standard pattern in perp-DEX design (Drift, Mango, dYdX, GMX all have variations of it) and is widely viewed as a feature rather than a vulnerability surface.

On 2023-08-07, an attacker exploited a logic flaw in Cypher's sub-account accounting. The defect was that Cypher enforced the solvency invariant per sub-account — each sub-account's collateral had to cover its open positions — but did not enforce the corresponding aggregate invariant at the trader level: that the sum of net withdrawable balances across a trader's sub-accounts could not exceed the sum of net deposits. The attacker constructed a sequence of inter-sub-account transfers and position changes that, at each individual sub-account, satisfied the local solvency check, but in aggregate produced a net withdrawal exceeding the actual collateral the attacker had deposited. The cumulative drain was approximately $1M.

For several weeks the attacker was pseudonymous; on-chain forensics traced the funds but did not produce a name. The attacker subsequently self-identified pseudonymously as "Hailey" in a public statement claiming the proceeds had been lost to a phishing scam and that recovery was no longer possible. Approximately $300k was returned across various points in the process; the remainder was retained.

In January 2025, US federal authorities arrested the individual behind the "Hailey" persona — identified in the unsealed Department of Justice indictment — and charged them with offences including wire fraud and computer-fraud-related counts. As of the OAK v0.1 cut, the case is one of the cleanest US-jurisdictional prosecution outcomes on the Solana-ecosystem worked-example record: pseudonymous self-disclosure followed by federal prosecution under conventional fraud statutes, with the on-chain technical record forming the evidentiary backbone of the indictment.

For OAK's purposes Cypher is the canonical Solana-side worked example of the sub-account-isolation logic-completeness T9.004 sub-class — distinct from the missing-input-validation sub-class (Cashio, Crema) and the arithmetic-correctness sub-class (Cetus). It is also the cleanest 2023 Solana-incident case where the attribution arc closes via federal prosecution rather than via on-chain bounty negotiation.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Cypher deploys perp-DEX contracts on Solana with multi-sub-account margin design; per-sub-account solvency invariants enforced; aggregate-trader-level net-debt invariant not enforced	T9.004 surface (latent — logic-completeness gap)
Pre-event	Attacker analyses Cypher's sub-account accounting and identifies the cross-account aggregate-invariant gap	(off-OAK pre-event observation)
2023-08-07	Attacker submits sequence of inter-sub-account transactions; at each sub-account the local solvency check passes; in aggregate net withdrawal exceeds net deposit; cumulative drain reaches ~$1M	T9.004 extraction
2023-08-07	Cypher detects anomalous account state; pauses protocol contracts	(operator response)
2023-08 (mid-late)	Cypher engages on-chain forensics; on-chain trace identifies attacker addresses but does not produce a name	(forensics)
2023-08 (later)	Attacker self-identifies pseudonymously as "Hailey" in a public statement; claims the funds were lost to a phishing scam; partial returns (~$300k cumulative across points)	(pseudonymous self-disclosure)
2023-09 onward	No further engagement; Cypher partially recovers; the protocol does not fully relaunch in its prior form	(operator response)
2025-01	US federal authorities arrest the individual behind the "Hailey" persona; DOJ unseals indictment naming the individual	prosecution
Continuing	DOJ case proceeding; on-chain technical record forms evidentiary backbone	(legal process)

What defenders observed

The bug was logic-completeness, not validation or arithmetic. Cypher's per-sub-account solvency check was correctly implemented; the math was correct; the input-validation surface was not the gap. The gap was in the set of invariants the protocol thought it was enforcing. Per-sub-account solvency was enforced; trader-level aggregate net-debt was not. This is a structurally distinct T9.004 sub-pattern from the missing-input-validation cluster (Cashio, Crema) — those failed to check what they had; Cypher checked everything it tracked, but did not track the right thing. Defenders writing T9.004 mitigations must treat invariant-coverage as a separate audit dimension from invariant-implementation-correctness.
Sub-accounting is a useful pattern with a hidden completeness obligation. Risk-isolation via sub-accounts is genuinely useful; Cypher's design intent (a loss in one sub-account does not cascade to others) is a real defensive property. The Cypher case does not refute the design pattern; it refutes a specific implementation of the pattern that lacked the cross-account aggregate invariant. The defender lesson is that sub-accounting increases the audit obligation rather than substituting for it: every sub-account requires its local invariants, and the trader-level aggregation requires its cross-account invariants. This is a per-protocol-design audit-checklist item that did not exist in the Solana ecosystem before Cypher and (informally) became a checklist item after it.
The attribution arc is unusual and instructive. Cypher's pseudonymous → self-identified → prosecuted arc is not the modal pattern for Solana-ecosystem exploits. Cashio attacker remained pseudonymous; Crema attacker was pseudonymous-with-private-attribution-via-bounty; Nirvana attacker remained pseudonymous and unengaged. Cypher is the only one of the four 2022-2023 Solana T9.004 cases in OAK v0.1 where the attribution arc closes via federal prosecution. Defenders writing attribution-pattern documentation should preserve this case as the demonstration that pseudonymous self-disclosure on social media (the "Hailey" statement) materially expands law-enforcement-side investigative leverage even when the on-chain forensics on their own do not produce a name.
The "lost to phishing" narrative is a recurring attacker post-incident framing. The "Hailey" statement framed the attacker as themselves a victim of downstream phishing. This narrative is a recurring pattern in the post-incident communication of pseudonymous attackers across multiple ecosystems; its defensive interpretation should be cautious. The Cypher prosecution implies that US federal authorities did not credit the framing as exculpatory. Worked examples should preserve attacker-claimed post-incident narratives as part of the timeline record without inheriting the claims.
$1M is a small absolute loss with a large structural-lesson value. Cypher's drain was not large by 2023 DeFi-exploit standards — $1M is at the lower bound of incidents OAK includes as worked examples. Its inclusion is justified by the structural distinctness of the T9.004 sub-pattern (the only sub-account-aggregation logic-completeness case at non-trivial scale on Solana in the v0.1 cohort) and by the prosecution outcome (the only US-prosecuted case in the Solana T9.004 cluster). Defenders writing case-selection criteria should treat "structural-class distinctness" and "prosecution-outcome uniqueness" as independent justifications for inclusion separate from absolute loss magnitude.

What this example tells contributors writing future Technique pages

T9.004 has a logic-completeness sub-class that is structurally distinct from missing-input-validation. Cashio and Crema failed because they did not check what they had; Cypher failed because it did not track what it should have tracked. Both fall under T9.004 in the broad construction, but the sub-class distinction matters for both audit-checklist construction and defender-side detection design. T9.004 pages should preserve the sub-class distinction.
Sub-account / multi-account / portfolio-level designs are a recurring logic-completeness exposure surface. Beyond Cypher, perp-DEX designs across Solana (Drift, Mango, Zeta), EVM (GMX, dYdX, Hyperliquid pre-launch), and Sui / Aptos all have variations of multi-account / multi-sub-account margin accounting. The cross-account aggregate-invariant audit obligation generalises across these designs. Worked examples in this design class should preserve the framing.
Pseudonymous self-disclosure is a real attribution-arc node. The Cypher case demonstrates that pseudonymous attacker self-disclosure on social media can be a material investigative input for downstream prosecution, even when the on-chain forensics on their own do not produce a name. Attribution-pattern documentation should preserve self-disclosure as a distinct node in the attribution arc, not collapse it into "pseudonymous."
Prosecution outcome is a real worked-example artefact. The DOJ indictment in January 2025 of the "Hailey" individual is part of the Cypher record. Worked examples that close via prosecution should preserve the legal-status framing (indictment vs conviction, charges, jurisdiction) without over-claiming legal certainty for cases that are still in process.

Public references

[cypherpostmortem2023] — Cypher Protocol official post-incident statement describing the sub-account-isolation logic flaw and the partial-recovery framework.
[rektcypher2023] — Rekt News forensic write-up of the Cypher exploit, including the cross-account aggregation framing.
[ottersecsolana2023cypher] — OtterSec on-chain analysis of the Cypher attack transaction sequence.
[dojcypher2025] — US Department of Justice indictment / press materials in the January 2025 arrest of the individual behind the "Hailey" persona.
[blocksecsolana2023cypher] — BlockSec analysis of the sub-account aggregate-invariant gap.
See also /examples/2022-03-cashio.md and /examples/2022-07-crema-finance.md for adjacent Solana T9.004 sub-classes.

Discussion

Cypher is OAK's canonical Solana-side worked example of the T9.004 logic-completeness sub-class — protocols failing not because they did not check the inputs they had, but because they did not track all the invariants the design required. The case sits adjacent to but distinct from the Cashio / Crema missing-input-validation cluster: those failed at the input layer, Cypher failed at the invariant-coverage layer.

The attribution arc — pseudonymous, then pseudonymous self-disclosure as "Hailey," then federal arrest and DOJ indictment in January 2025 — is unusual on the Solana-ecosystem worked-example record and gives Cypher a documentable prosecution outcome that the other Solana T9.004 cases (Cashio, Crema, Nirvana) do not have. Contributors writing attribution-pattern or law-enforcement-pathway documentation should preserve this as the demonstration that on-chain technical records, combined with attacker pseudonymous self-disclosure, can produce US-jurisdictional prosecution outcomes even at sub-$1M absolute-loss magnitudes.

For OAK's broader Solana-ecosystem coverage, Cypher closes the third major link in the Cashio → Crema → Cypher chronological cluster of Solana T9.004 cases, with each case instantiating a distinct T9.004 sub-class (missing-input-validation, missing-input-validation-flash-loan-amplified, sub-account-aggregation logic-completeness). The cluster is the empirical basis for treating Solana-side T9.004 as a real, recurrent class with internal sub-structure that the v0.x Technique-page layer should explicitly model.

Techniques demonstrated (1)

OAK-T9.004 Access-Control Misconfiguration