Worked example · 2024-09
DeltaPrime admin-key compromise + malicious upgrade — Arbitrum + Avalanche — 2024-09-16/17
- Entry vector: not mapped. (This bullet previously claimed OAK-T11.002 under the name "Wallet-Software / Operator-Key Compromise". T11.002 is Wallet-Software Distribution Compromise — a tampered build or distribution channel — which is not what happened here. No T11 sub-Technique covers generic operator-key compromise with an unestablished vector.) The proximate cause per Halborn, PeckShield, and CertiK post-incident write-ups was compromise of an operator-side admin private key with
ProxyAdminupgrade authority over the Pool contracts. OAK v0.1 has no exact entry-vector match for "operator admin EOA with proxy-admin authority compromised by unknown off-chain means"; No T11 sub-Technique fits — DeltaPrime is a worked example of the same operator-side key-custody gap that recurs across the corpus (KuCoin 2020, Stake.com 2023, Phemex 2025). - OAK-T9.004 (Access-Control Misconfiguration) as the extraction mechanism. The compromised key was authorised to replace the Pool implementation contract on a live deployment without timelock, multisig threshold, or upgrade-quorum gating. The malicious replacement contract retained the storage layout but flipped the pool-balance accounting in the attacker's favour, allowing a single subsequent call to drain the pool. The on-chain extraction mechanism is access-control: the upgrade authority itself, not a Solidity-language bug. OAK-T7.001 (Mixer-Routed Hop — proceeds were laundered into Tornado Cash).
Summary
DeltaPrime is a leveraged-yield / margin-account protocol launched in 2023 on Avalanche, with an Arbitrum deployment added subsequently. The protocol's depositor-facing surface is a set of single-asset Pool contracts (USDC, ETH, BTC, etc.); user margin positions are held in per-user Prime Account contracts that borrow from the Pools and deploy borrowed capital across integrated venues (DEX LPs, yield aggregators). The Pool contracts custody the bulk of protocol TVL and are the high-value target.
On 2024-09-16, an attacker holding the private key of the DeltaPrime admin EOA executed a contract upgrade via the protocol's proxy-admin entrypoint, replacing the live Pool implementation on Arbitrum with an attacker-controlled implementation. The replacement implementation preserved the storage layout (so the upgrade did not visibly corrupt accounting state in a way the indexer would surface immediately) but altered the balance / withdrawal logic such that a follow-on call drained the pool's underlying-asset reserves to an attacker address. The same key carried equivalent authority on the Avalanche deployment; roughly twenty-four hours later, on 2024-09-17, the attacker repeated the pattern on Avalanche, extracting an additional ~$0.38M before DeltaPrime locked the Avalanche-side proxy-admin authority.
The proximate-cause framing converged across forensic write-ups (Halborn, PeckShield, CertiK, SlowMist): the entry vector was off-chain key compromise of an operator EOA carrying proxy-admin upgrade authority over live custody-bearing contracts on two chains, with no timelock, no multisig threshold, and no per-chain key segregation. The on-chain manifestation — a malicious upgrade followed by a single drain call — is the canonical OAK-T9.004 extraction shape; the load-bearing lesson is in the off-chain custody surface that admitted the entry vector.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| Pre-event | DeltaPrime operates with a single admin EOA carrying proxy-admin upgrade authority over Pool contracts on both Arbitrum and Avalanche; no timelock / multisig threshold gating in place at the proxy-admin layer | (custody-surface precondition) |
| Pre-event | Attacker compromises the admin EOA via undisclosed off-chain means (no public attribution to phishing, malware, infrastructure compromise, or insider misuse) | (entry vector — not mapped) |
| 2024-09-16 (Arbitrum attack window) | Attacker calls the proxy-admin upgrade entrypoint on the Arbitrum Pool contract, swapping the live implementation for an attacker-controlled implementation that preserves storage layout but alters balance / withdrawal logic | T9.004 (upgrade authority abuse) |
| 2024-09-16 (within minutes) | Attacker calls the malicious-implementation function path that drains pool reserves; ~$5.6M extracted on Arbitrum | T9.004 extraction |
| 2024-09-16 (hours) | DeltaPrime team detects the drain; pauses the Arbitrum deployment; publicly acknowledges the incident; announces reimbursement intent | (operator response) |
| 2024-09-17 (Avalanche attack window) | Attacker repeats the upgrade-and-drain pattern on the Avalanche Pool deployment using the same compromised admin key; ~$0.38M extracted | T9.004 (parallel-deployment follow-on) |
| 2024-09-17 (within hour) | DeltaPrime locks Avalanche proxy-admin authority; rotates all admin keys; engages forensic firms | (operator response) |
| 2024-09-17 onward | Attacker laundering routes proceeds through Tornado Cash and cross-chain rails | T7.001 / T7.003 (off this example's framing) |
| 2024-09 onward | Halborn, PeckShield, CertiK, SlowMist publish post-incident write-ups converging on the proxy-admin-upgrade-via-compromised-key root cause | (transparency / cohort signal) |
| 2024-09 — 2024-Q4 | DeltaPrime publishes reimbursement plan funded from protocol reserves and treasury allocations; user-level make-whole proceeds in stages | (recovery state, off-chain only) |
What defenders observed
- Proxy-admin upgrade authority is custody. Any single key with the authority to replace a live custody-bearing implementation contract has effective custody of every asset that contract holds, regardless of whether the protocol's user-facing documentation describes the design as "non-custodial." DeltaPrime's Pool contracts custody depositor funds; the proxy-admin EOA had unilateral authority to replace the implementation; therefore the proxy-admin EOA had custody. Defender threat models that distinguish "smart-contract risk" from "custody risk" miss this entirely. The Onyx case at
/examples/2024-09-onyx.mdshows the on-chain-bug branch of the September 2024 lending-protocol-loss cluster; DeltaPrime shows the off-chain-key branch, and the two together establish that 2024 lending-protocol losses were not concentrated in a single root-cause class. - Per-chain key segregation matters at minute-level latency. The Avalanche follow-on landed roughly twenty-four hours after the Arbitrum drain. The DeltaPrime team's response window was sufficient to acknowledge the Arbitrum incident publicly and pause the Arbitrum deployment but not sufficient to rotate the admin key on the Avalanche-side parallel deployment before the attacker reached it. Multi-chain operators with shared admin authority across deployments need (a) per-chain key isolation, or (b) a synchronised pause-and-rotate primitive that fires on first-chain detection. DeltaPrime had neither at the time of the incident. The Phemex case at
/examples/2025-01-phemex.mdmakes the same multi-chain-key-store-co-location point on the exchange-custody side; DeltaPrime is the DeFi-protocol-side companion datapoint. - The malicious-upgrade signature is on-chain-detectable in real time, but only with the right monitoring. Each step of the attack — the upgrade transaction at the proxy-admin entrypoint, the implementation-address change event, the subsequent extraction call against the new implementation — is publicly visible at the moment of mining. Runtime monitoring services (BlockSec PhalconHQ, Forta, OpenZeppelin Defender, Hypernative) can flag implementation-address changes on configured proxies; protocols with high TVL on upgradable contracts should treat such monitoring as mandatory rather than optional. The detection-latency floor on Arbitrum was set by the protocol's own monitoring posture, not by inherent on-chain visibility.
- Timelock gating on proxy-admin authority would have changed the recovery surface. A standard 24-to-72-hour timelock between scheduling and executing a proxy-admin upgrade would have given defenders a window to detect and cancel a malicious-upgrade transaction before it reached the implementation-change point, regardless of whether the underlying admin key was compromised. The 2017 Parity multisig case at
/examples/2017-07-parity-multisig.mdand the broader OAK-T9.004 worked-example set make this a recurring lesson; DeltaPrime is the 2024 lending-protocol case that re-establishes its currency. - Attribution is pseudonymous and is the realistic attribution status for this class. Funding and laundering both routed through Tornado Cash; no industry forensics provider has converted the on-chain analysis into a named-individual or state-actor claim. Contributors should not over-claim attribution by analogy to the temporally-adjacent OAK-G01 wave; the 2024 OAK-G01 cluster (DMM, WazirX, Radiant) is documented separately and DeltaPrime is not part of it on the public record.
What this example tells contributors writing future Technique pages
- OAK-T9.004 covers upgrade-authority abuse, not only function-level access-control bugs. The DeltaPrime case is the canonical 2024 worked example for the upgrade-authority-as-access-control sub-pattern of T9.004. Worked examples should make this sub-pattern explicit; the contract was not exploitable through a function-level access-control bug in the deployed code, it was exploitable through the existence of an external authority that could replace the deployed code. The Tapioca DAO case at
/examples/2024-10-tapioca.mdis the directly comparable 2024 worked example of the same sub-pattern with a slightly different operator-key-custody story. - The OAK-T11 entry-vector taxonomy gap continues to be the most-exploited gap in OAK v0.1. DeltaPrime sits in the same off-chain-key-compromise entry-vector class as KuCoin (2020), Stake.com (2023), and Phemex (2025), and shares the structural feature that no published forensic analysis identifies the proximate compromise vector (phishing, malware, infrastructure compromise, insider). A future v0.x update should add a T11.x sub-Technique covering operator-side admin-EOA compromise on DeFi protocols specifically; DeltaPrime is the natural worked example for that sub-Technique.
- Treasury-backed reimbursement is a genuine but partial recovery primitive. DeltaPrime made depositors whole from protocol reserves and treasury allocations; this is a meaningfully better depositor outcome than the Penpie / Onyx / Phemex zero-recovery base rate, but it is not on-chain recovery and it does not reduce attacker proceeds. Contributors writing recovery sections should distinguish (a) on-chain-recovery (Cetus 2025, Euler 2023), (b) attacker-return-of-funds (Tapioca 2024, Thala 2024), (c) treasury-backed reimbursement (DeltaPrime 2024), and (d) zero-recovery (Phemex 2025, Penpie 2024) as distinct outcome classes with different defender lessons.
- Cohort framing of "September 2024 DeFi losses" is analytically useful. Onyx (T9.005 rounding-error), Penpie (T9.005 reentrancy), and DeltaPrime (T9.004 upgrade-authority abuse) all landed within the same calendar month with overlapping forensic-firm coverage. The cohort spans three distinct OAK-T9 sub-classes and is a useful teaching set for the breadth of the T9 family in a single month of 2024.
Public references
[deltaprimepostmortem2024]— DeltaPrime post-incident statement covering the Arbitrum and Avalanche drains, the proxy-admin-key compromise, and the reimbursement plan.[halborndeltaprime2024]— Halborn post-incident technical write-up of the DeltaPrime exploit, including the malicious-upgrade transaction-trace breakdown.[peckshielddeltaprime2024]— PeckShield headline figures and on-chain analytics for the DeltaPrime September 2024 drain across Arbitrum and Avalanche.[certikdeltaprime2024]— CertiK forensic analysis emphasising the proxy-admin upgrade-authority surface and the absence of timelock gating.[slowmistdeltaprime2024]— SlowMist incident analysis covering funding-source tracking and Tornado Cash laundering.[rektdeltaprime2024]— Rekt public-facing incident summary.
Discussion
DeltaPrime is OAK's canonical 2024 worked example of proxy-admin-upgrade-authority abuse via operator-key compromise and is the off-chain-key-branch companion to the on-chain-bug Onyx and Penpie cases in the September 2024 cohort. The three together establish that the 2024 lending-protocol loss surface was not dominated by a single root-cause class: rounding-error (Onyx), cross-protocol reentrancy (Penpie), and upgrade-authority abuse (DeltaPrime) all fired in the same month against materially-similar protocol categories.
The off-chain entry vector — a single admin EOA with proxy-admin upgrade authority on live custody-bearing contracts across two chains, with no timelock, no multisig threshold, and no per-chain segregation — is the part of the case that the OAK v0.1 Technique taxonomy does not address with a clean entry-vector match. T11.002 (wallet-software distribution compromise) is the closest sibling Technique, but the DeltaPrime entry vector is not a wallet-software supply-chain compromise; it is operator-side custody of the upgrade-authority key, and the public forensic record is silent on the proximate compromise vector. The case sits in the same OAK-T11-shaped gap as KuCoin, Stake.com, and Phemex, and adds a DeFi-specific colour to a gap that the corpus has so far documented mostly through exchange-custody examples.
The malicious-upgrade pattern itself — replace implementation, drain via new implementation — has become the canonical OAK-T9.004 upgrade-authority extraction shape for 2024–2025 incidents. Tapioca DAO (October 2024, /examples/2024-10-tapioca.md) is the immediate cohort companion. Both cases reinforce the lesson that any deployment with single-key proxy-admin authority over custody-bearing contracts is structurally one off-chain compromise away from total loss, and that timelock gating is the lowest-cost mitigation that meaningfully changes the recovery surface even under full key compromise.
The attribution status is pseudonymous and should remain so absent new public evidence. Contributors should resist the temptation to fold DeltaPrime into the temporally-adjacent OAK-G01 wave by analogy; the 2024 OAK-G01 cluster (DMM, WazirX, Radiant) is documented through explicit industry-forensic and FBI attribution chains, and DeltaPrime is not part of those chains as of this writing.