Worked example · 2023-11

dYdX V3 SUSHI/YFI targeted market manipulation and insurance-fund drain — dYdX V3 (StarkEx L2) — 2023-10-29 to 2023-11-18

Loss: approximately $9 million drained from dYdX V3's insurance fund (fund balance dropped from ~$22.5M to ~$13.5M). The attacker withdrew approximately $27 million in profits across the SUSHI and YFI phases against total deposits of approximately $16 million, yielding a net extraction of approximately $11 million from dYdX plus approximately $5 million from the SUSHI phase alone. The YFI crash on November 18 triggered approximately $50 million in total liquidations on dYdX. No user funds were affected — the insurance fund absorbed the shortfall.
OAK Techniques observed: OAK-T17.001 (Cross-Venue Arbitrage-Driven Price-Discovery Distortion — primary; the attacker opened 5× leveraged long positions on dYdX V3 across 100+ wallets, then executed coordinated spot buying of SUSHI and YFI on external venues to pump the oracle reference price, inflating unrealized P&L on the dYdX positions and withdrawing the inflated equity before the price correction) + OAK-T17.002 (Liquidation Cascade Engineering — the YFI crash on November 18 triggered ~$50M in cascading liquidations on dYdX V3; the attacker's positions went into negative equity and the insurance fund covered ~$9M in losses) + OAK-T8.001 (Common-Funder Cluster Reuse — 100+ wallet addresses connected to dYdX V3 were all funded from a single root Ethereum address 0xccb6f95b350ca6f9d3285d61a60ea54715a4bc27, providing the load-bearing attribution signal) + OAK-T6 (Defense Evasion — the multi-wallet structure was designed to evade per-account position-size limits and open-interest concentration detection; the deposit-withdraw-cycle-via-new-wallets pattern was the operational evasion mechanism).
Attribution: pseudonymous — dYdX's post-mortem states that "investigative results have uncovered the identity of the attacker and we are in contact with them" and that the team is "assisting law enforcement" and "exploring legal remedies." The attacker's identity was not publicly named in the January 2024 post-mortem. The root Ethereum address (0xccb6f95b350ca6f9d3285d61a60ea54715a4bc27) funding all 100+ dYdX wallets is the load-bearing on-chain attribution surface.
Key teaching point: The dYdX SUSHI/YFI case is the canonical anchor for the unrealized-P&L-withdrawal-as-extraction-primitive sub-pattern of T17.001. The attacker did not need to close positions at a profit — dYdX V3's margining system counted unrealized P&L as account equity, allowing the attacker to withdraw the inflated equity while the spot pump was active. When the pump ended and YFI crashed, the positions went underwater and the insurance fund absorbed the loss. The structural lesson is that counting unrealized P&L as withdrawable equity on leveraged positions with cross-venue price-reference dependency creates a T17.001 extraction surface by construction.
Phase 1 — SUSHI (October 29 to November 3, 2023): The attacker deposited approximately $5.3M in USDC, opened 5× leveraged long positions in SUSHI-USD across multiple wallets, and executed coordinated spot buying of SUSHI on external venues. SUSHI's price surged approximately 180% (from ~$0.67 to ~$1.20) between October 31 and November 3. On November 1, dYdX raised SUSHI's initial margin fraction (IMF) to 100% in response to abnormal activity, pausing the withdrawal cycle. When the IMF was restored to 25% on November 3, the attacker withdrew ~$5M in profits. SUSHI stabilized above $1 and the attacker exited the SUSHI phase profitably.
Phase 2 — YFI (November 1 to November 18, 2023): The attacker scaled the same pattern to YFI-USD. YFI open interest on dYdX surged from ~$0.8M to ~$67M in the days before the crash — nearly half of all YFI open interest across exchanges. YFI's price jumped approximately 215% (from ~$6,500 to ~$14,000+) from November 9 to November 17. On November 17, dYdX adjusted YFI market parameters (reducing base position size and incremental position size). On November 18 at approximately 5:00 AM UTC, YFI crashed approximately 30% in one hour. The attacker attempted but largely failed to close positions before the crash — with "no liquidity available," per dYdX's post-mortem, most positions were liquidated only after the oracle price fell below the bankruptcy price. Accounts went into negative equity, and the insurance fund covered approximately $9M in losses. dYdX found no evidence the attacker held short positions or profited from the crash itself.

Summary

In late October through mid-November 2023, an attacker executed a two-phase targeted manipulation of dYdX V3's SUSHI-USD and YFI-USD perpetual markets. The attacker's operational pattern was: (1) deposit → (2) open 5× leveraged long positions across multiple wallets → (3) pump the spot price on external venues → (4) withdraw inflated unrealized P&L → (5) cycle withdrawn funds through new wallets to repeat. The extraction primitive was the withdrawal of unrealized P&L during the spot-pump window — the attacker did not need to close positions profitably because the paper profits were withdrawable as account equity.

The combined extraction: the attacker withdrew ~$27M in total profits against ~$16M in total deposits, yielding a net extraction of ~$11M from dYdX. The insurance fund absorbed an additional ~$9M in losses from the YFI crash liquidation shortfall.

dYdX published its post-mortem on approximately January 3, 2024, disclosing that the attacker's identity had been uncovered and that the team was cooperating with law enforcement. The post-mortem also announced structural changes to dYdX V3's margining system (auto-adjusting IMF on abnormal activity, improved OI monitoring) and to the then-upcoming dYdX Chain (V4) design (redesigned liquidation engine with automatic deleveraging, variable margin fraction, data-driven market availability).

Timeline (UTC)

When	Event	OAK ref
2023-10-29 to 2023-11-03	Phase 1 — SUSHI: Attacker deposits ~$5.3M, opens 5× leveraged longs on SUSHI-USD across multiple wallets, executes coordinated spot buying on external venues	T17.001 (cross-venue spot-pump to inflate perp P&L); T8.001 (100+ wallets from root `0xccb...`)
2023-10-31 to 2023-11-03	SUSHI price surges ~180% ($0.67 → $1.20); dYdX raises SUSHI IMF to 100% on Nov 1, restores to 25% on Nov 3	T17.001 (spot-pump active window)
2023-11-03	Attacker withdraws ~$5M in SUSHI-phase profits after IMF restoration	T17.001 (P&L withdrawal — extraction primitive)
2023-11-01 to 2023-11-10	Phase 2 — YFI: Attacker scales pattern to YFI-USD; position building across 100+ wallets	T17.001 (phase 2 deployment)
2023-11-09 to 2023-11-17	YFI price jumps ~215% ($6,500 → $14,000+); YFI OI on dYdX surges from $0.8M to $67M (~50% of global YFI OI)	T17.001 (spot-pump scaling); T6 (OI concentration obscured by multi-wallet structure)
2023-11-17	dYdX adjusts YFI market parameters (reduces base position size, incremental position size)	(defender-side parameter adjustment)
2023-11-18 (~05:00 UTC)	YFI crashes ~30% in one hour; attacker attempts but fails to close positions; accounts go into negative equity; ~$50M liquidated on dYdX	T17.002 execution (liquidation cascade); insurance fund loses ~$9M
2024-01-03 (approx.)	dYdX publishes post-mortem; discloses attacker identification, law-enforcement cooperation, and structural V3/V4 changes	(defender-side post-mortem and remediation)

What defenders observed

Pre-event (single-funder signal): All 100+ dYdX-connected wallets were funded from a single root Ethereum address (0xccb6f95b350ca6f9d3285d61a60ea54715a4bc27). A defender-side monitoring framework that tracked funder-graph clustering across dYdX deposit addresses would have surfaced the single-operator structure before the manipulation reached extraction scale. The root address → distribution wallets → dYdX deposit wallets chain is the canonical T8.001 signal.
At-event (OI surge): YFI open interest on dYdX surged from ~$0.8M to ~$67M in days — an anomalous concentration that represented nearly half of all global YFI open interest. Normal YFI trading on dYdX was infrequent; the OI surge was a structural anomaly signal independent of the funder-graph signal.
At-event (spot-perp price distortion): The attacker's coordinated spot buying on external venues pushed YFI's spot price up ~215%, which the dYdX oracle consumed as the mark price for YFI-USD perpetuals. The inflated mark price inflated the attacker's unrealized P&L, and the withdrawal of unrealized P&L was the extraction primitive. The spot-pump-to-inflate-perp-P&L pattern is the distinctive T17.001 signal for this case.
At-event (IMF cycling evasion): When dYdX raised SUSHI's IMF to 100% on November 1, the attacker could not withdraw unrealized P&L because the higher IMF reduced withdrawable equity. The attacker waited for the IMF to be restored to 25% on November 3, then withdrew immediately. The IMF-raise-then-restore cycle was an incomplete mitigation — it paused the extraction but did not close the surface, and the withdrawal resumed immediately upon restoration.
Post-event (insurance-fund drain): The insurance fund dropped from ~$22.5M to ~$13.5M, absorbing ~$9M in losses from negative-equity liquidations during the YFI crash. The insurance fund was the loss-absorbing counterparty, not individual lenders or LPs — structurally distinct from lending-market liquidation cascades where individual depositors bear the loss.

What this example tells contributors writing future Technique pages

The unrealized-P&L-withdrawal primitive is structurally distinct from the liquidation-profit primitive. In the TRB case (December 2023), the manipulator profited from cascading liquidations on both sides of the perp order book. In the dYdX case, the attacker profited from withdrawing unrealized P&L during the spot-pump window, and the insurance fund absorbed the subsequent crash losses. The two primitives are operationally distinct and require different detection surfaces. Future T17.001 technique pages should distinguish the unrealized-P&L-withdrawal sub-pattern (dYdX 2023) from the liquidation-cascade-profit sub-pattern (TRB 2023).
The 100+-wallet structure is the canonical T17.001 defense-evasion overlay. The attacker used 100+ wallets to evade per-account position-size limits and OI-concentration detection. The single root funder address was the load-bearing attribution signal that collapsed the 100-wallet structure to a single operator. Future T17.001 worked examples should record the wallet-count-to-funder-cluster ratio — the higher the ratio, the more deliberate the defense-evasion overlay.
IMF cycling is an incomplete mitigation when unrealized P&L is withdrawable. dYdX's IMF raise to 100% paused the extraction but did not close the surface — the attacker simply waited for the IMF to be restored and withdrew immediately. A permanent restriction on unrealized-P&L withdrawal during abnormal-activity windows (or a settlement-delay mechanism on P&L withdrawals from levered positions) would close the surface. Future technique pages covering perp-DEX risk-parameter design should flag the withdrawable-unrealized-P&L primitive as a T17.001 design vulnerability.
dYdX V4's redesigned liquidation engine is the direct remediation. The V4 chain's automatic deleveraging (ADL) fallback and variable margin fraction are designed to ensure that only position-holders bear liquidation risk, not the insurance fund. The dYdX V3-to-V4 design migration from insurance-fund-as-backstop to ADL-as-backstop is the canonical T17.002 remediation pathway. Future contributors writing perp-DEX design guidance should reference the dYdX V3→V4 migration as the operational precedent.

Public references

[dydx2024postmortem] — dYdX, "Post Mortem on SUSHI and YFI Incident" (2024-01-03): https://dydx.exchange/blog/sushi-yfi-incident
[cointelegraphdydx2024] — CoinTelegraph, "dYdX identifies attacker, considers legal action over $9M loss" (2024-01).
[theblockdydx2024] — The Block, "DeFi exchange dYdX publishes post-mortem on $9 million November attack" (2024-01).
[forklogdydx2023] — ForkLog, "dYdX loses $9 million in what is described as a targeted attack" (2023-11).
[coindeskdydx2023] — CoinDesk, "dYdX Founder Claims Targeted Attack, Initiates $9M Insurance Payout" (2023-11).

Citations

[dydx2024postmortem] — primary post-mortem; attack mechanism, root funder address, wallet count, P&L withdrawal cycle, IMF adjustments, OI surge data, insurance fund impact, V4 remediation design.
[forklogdydx2023] — contemporaneous reporting; $9M figure, YFI OI surge, insurance fund balance trajectory, dYdX founder statement.

Discussion

The dYdX SUSHI/YFI case is the canonical anchor for the unrealized-P&L-withdrawal-as-extraction-primitive sub-pattern of T17.001, structurally distinct from the liquidation-cascade-profit sub-pattern exemplified by TRB (December 2023). The two cases together span the principal extraction primitives available to a T17.001 attacker on a perpetual-futures DEX: (a) withdraw inflated unrealized P&L during the spot-pump window, letting the insurance fund absorb the subsequent crash losses (dYdX 2023), or (b) engineer a dual-direction liquidation cascade that liquidates shorts during the pump and longs during the crash (TRB 2023).

The case also anchors the multi-wallet defense-evasion overlay that is the recurring T17.001 operational pattern. The attacker's use of 100+ wallets funded from a single root address is structurally identical to the TRB whale-cluster pattern (20+ wallets accumulating at a common cost basis) and the Hyperliquid POPCAT pattern (19-26 coordinated wallets funded from OKX/Bybit). The 100+:1 wallet-to-funder ratio is the canonical T8.001 signal for T17.001 cases — defenders should expect future T17.001 attackers to use multi-wallet structures and should treat funder-graph clustering as the primary attribution surface.

The dYdX V3→V4 design migration is the operational precedent for perp-DEX remediation against the T17.001/T17.002 surface. The V4 chain's automatic deleveraging (ADL) fallback, variable margin fraction, and data-driven market availability are design primitives that close the unrealized-P&L-withdrawal surface and the insurance-fund-as-loss-absorber surface. Future perp-DEX designs should incorporate these primitives at genesis rather than retrofitting them after an incident.

The case's principal limitation at v0.1 is the non-public attacker identity. dYdX stated that the attacker's identity was uncovered and that law enforcement was engaged, but the identity was not publicly disclosed in the post-mortem. The case sits at the boundary between pseudonymous-attribution (strong on-chain cluster evidence via the root funder address) and confirmed attribution (law-enforcement engagement implies identification but not public naming). Future updates may reclassify the case if the attacker is publicly named through legal proceedings.