Worked example · 2025-01

Mango Markets SEC settlement and protocol shutdown — Solana — 2024-09 to 2025-01

Loss: $1.2M cumulative civil penalties ($700K SEC + $500K CFTC) plus the structural cost of protocol wind-down and MNGO token destruction, against a project that had previously suffered the ~$110M Eisenberg oracle-manipulation exploit (October 2022; covered at examples/2022-10-mango-markets.md). The 2024-2025 case is not a new exploit incident; it is the regulatory-enforcement-and-shutdown closure of the 2022-Q4 - 2025-Q1 Mango Markets timeline. The structural significance of the closure is the establishment of a regulatory-enforcement template against Solana-native DeFi protocols whose token launch produced unregistered securities offerings and unregistered broker activity. Per the SEC press release (September 27, 2024), Mango DAO and Blockworks Foundation raised over $70M from unregistered offers and sales of MNGO tokens starting in August 2021.
Recovery: the SEC settlement requires Mango DAO to destroy MNGO tokens, delist them from exchanges, and pay civil penalties. There is no public restitution surface for the original Eisenberg exploit's victims beyond the prior 2022-2023 governance-vote-recovery process; the 2024-2025 closure is a regulatory action, not a victim-recovery action.
OAK Techniques observed: OAK-T9.001 (Oracle Price Manipulation — the underlying Eisenberg exploit of October 2022; see examples/2022-10-mango-markets.md). OAK-T6.007 (Trust-Substrate Shift / Vendor-Promise Revocation — the SEC settlement requiring MNGO token destruction and exchange delisting represents a regulatory-enforcement-induced trust-substrate shift; the protocol's governance token lost its tradable-exchange-surface and the protocol shut down as a direct consequence of the regulatory enforcement action).
Attribution: confirmed at the regulatory level. SEC v. Mango DAO and Blockworks Foundation (settled September 27, 2024) is a regulator-attributed action with full public-record forensic anchoring (SEC press release 2024-154; SEC complaint and settlement documents). CFTC parallel settlement adds the same. The earlier Eisenberg conviction (April 2023) was vacated by U.S. District Judge Arun Subramanian on May 23, 2025 on intent-to-defraud-not-proven grounds; the Eisenberg-side attribution at v0.1 is therefore confirmed at action-level via CFTC charges, criminal-conviction-vacated as of 2025-Q2. The case is structurally distinct from the broader pseudonymous-DeFi-exploit corpus because both the protocol-side enforcement (SEC + CFTC) and the actor-side prosecution-and-vacatur are public-record federal proceedings.
Key teaching point: DeFi-protocol shutdown via regulatory settlement after a major exploit is now an established 2024-2025 template, with material implications for Solana DeFi defender-tooling and protocol-design discipline. Mango Markets' trajectory — ~$70M unregistered token raise (2021) → ~$110M oracle-manipulation exploit (October 2022) → governance-vote settlement with the exploiter (October-November 2022) → CFTC charges against Eisenberg (2023) → SEC settlement (September 2024) → MNGO destruction and protocol wind-down (January 2025) → criminal conviction vacated (May 2025) — is the canonical 2021-2025 trajectory for a Solana DeFi protocol that grew to material scale before regulatory enforcement caught up. The structural lesson is that the regulatory-enforcement layer on Solana DeFi is now operationally active; protocols that operated with token-distribution / broker-activity surfaces that the SEC characterises as unregistered-securities-offerings and unregistered-broker-activity face structurally-real regulatory-enforcement risk that may produce protocol shutdown as the resolution path. Defender-tooling work for Solana DeFi v0.x should treat regulatory-enforcement-induced shutdown as a discrete defender-relevant outcome category, distinct from on-chain-exploit-induced shutdown and from voluntary protocol wind-down.

Summary

Mango Markets is a Solana-native decentralised futures and lending exchange that operated from 2021 through January 2025. The protocol's history spans four discrete phases at v0.1's cutoff:

Token distribution and growth (August 2021 - October 2022). Mango DAO and Blockworks Foundation raised over $70M from unregistered offers and sales of MNGO governance tokens beginning in August 2021. The protocol grew to material scale as a Solana-native perpetuals-and-lending venue.
Eisenberg oracle-manipulation exploit (October 11, 2022). Avraham "Avi" Eisenberg manipulated the price of MNGO on the venues feeding Mango's oracle (FTX, AscendEX, Serum), inflated his collateral position, and borrowed approximately $110M against the inflated valuation. Eisenberg subsequently negotiated a ~$67M-net governance-vote settlement with Mango Markets, returning a portion of the funds in exchange for the protocol agreeing not to pursue civil action. See examples/2022-10-mango-markets.md for the canonical T9.001 worked example. The CFTC subsequently charged Eisenberg with manipulative and deceptive scheme; he was convicted in April 2023.
SEC and CFTC enforcement (September 27, 2024). The SEC filed settled charges against Mango DAO, Blockworks Foundation, and Mango Labs LLC for the unregistered offers and sales of MNGO tokens (covering the August 2021 onward period) and for unregistered broker activity in connection with various crypto assets being offered and sold as securities on the Mango Markets platform. The CFTC settled parallel charges. The combined civil penalties were $1.2M ($700K SEC + $500K CFTC). The settlement required Mango DAO to destroy MNGO tokens and delist them from exchanges. Bloomberg, CoinDesk, The Block, Yahoo Finance, and CoinMarketCap Academy published coverage of the settlement.
Protocol shutdown (January 2025) and Eisenberg conviction vacated (May 2025). On January 11, 2025, Mango Markets announced it was "shutting down" — governance proposals to adjust interest rates and collateral requirements, effectively ending borrowing and lending on the platform, were set to take effect on January 13, 2025. Subsequently, on May 23, 2025, U.S. District Judge Arun Subramanian vacated Eisenberg's criminal conviction on the grounds that the prosecution had failed to prove intent to defraud — the conviction was overturned on intent / venue grounds, not on factual innocence.

The case is the canonical 2021-2025 Solana DeFi regulatory-enforcement trajectory. The combination of (a) a SEC unregistered-securities-offering settlement against the protocol's token distribution, (b) a CFTC manipulation charge against an external exploiter (subsequently vacated), and (c) a protocol shutdown as the closure resolution establishes a regulatory-enforcement template that defender-tooling work and protocol-design discipline should track for Solana DeFi v0.x.

Why this is structurally significant

The Mango Markets 2024-2025 closure is structurally informative for OAK's broader Solana DeFi coverage in three ways:

The protocol-side shutdown is the SEC-settlement-induced closure of a Solana DeFi protocol that had previously suffered a major exploit. Mango is the highest-profile 2021-2025 case where regulatory enforcement against the protocol's token distribution produced a protocol shutdown. The structural lesson is that Solana DeFi protocols with token-distribution surfaces that the SEC characterises as unregistered-securities-offerings face real shutdown risk; the regulatory-enforcement-induced-shutdown outcome category is a defender-relevant outcome class that future Solana DeFi worked examples should track.
The Eisenberg conviction-vacatur establishes a 2025-Q2 precedent on intent-to-defraud framing for DeFi-oracle-manipulation prosecution. Judge Subramanian's vacatur (May 23, 2025) found that the prosecution had failed to prove intent to defraud — the structurally-novel argument is that DeFi-oracle-manipulation that operates within the protocol's published rules may not satisfy the federal-criminal-fraud intent element. The vacatur does not establish that Eisenberg's actions were lawful (CFTC's market-manipulation case stands; the SEC settlement against Mango DAO stands); it establishes that the criminal-conviction surface for intent-based DeFi prosecution is structurally narrower than the prosecution had argued. Defender-tooling work for DeFi-oracle-manipulation prosecution should preserve this 2025-Q2 framing.
The combined SEC + CFTC + criminal-vacatur trajectory produces a multi-axis attribution shape. The case has confirmed regulatory-enforcement at the protocol-side (SEC settlement against Mango DAO), confirmed-then-vacated criminal-prosecution at the exploiter-side (Eisenberg April 2023 conviction → May 2025 vacatur), and ongoing CFTC market-manipulation case at the exploiter-side. OAK's attribution-strength taxonomy should preserve the multi-axis attribution shape — different parts of the same case produce different attribution-strengths against different actors at different layers.

The case generalises beyond Mango. The SEC's posture in the Mango settlement — characterising MNGO governance tokens as unregistered securities and the protocol's offering activity as unregistered broker activity — extends across other 2021-2024 Solana DeFi protocols with comparable token-distribution surfaces. Future contributors writing Solana DeFi worked examples should preserve the regulatory-enforcement-trajectory framing as a discrete observable, distinct from the on-chain-exploit framing that dominates the v0.1 corpus.

Timeline (UTC)

When	Event	OAK ref
2021-08	Mango DAO and Blockworks Foundation begin unregistered offers and sales of MNGO governance tokens; cumulative raise eventually exceeds $70M (per SEC complaint)	(token-distribution genesis)
2022-10-11	Avraham Eisenberg executes oracle-manipulation exploit; ~$110M extracted; covered at `examples/2022-10-mango-markets.md`	T9.001 oracle exploit
2022-10 → 2022-11	Mango governance vote settlement with Eisenberg; ~$67M-net returned in exchange for no-civil-action agreement	(negotiated recovery)
2022-12 to 2023	CFTC charges Eisenberg with manipulative and deceptive scheme; SEC opens parallel investigation	(regulatory-enforcement initiation)
2023-04	Eisenberg convicted on federal charges related to the Mango exploit	(criminal conviction — initial)
2024-09-27	SEC settles charges against Mango DAO, Blockworks Foundation, and Mango Labs LLC for unregistered offers and sales of MNGO tokens and unregistered broker activity; $700K SEC civil penalty; settlement requires MNGO destruction and delisting	SEC-settlement-induced shutdown surface
2024-09-27	CFTC parallel settlement; $500K CFTC civil penalty	(regulator-coordination layer)
2024-09-27 → 2025-01	Mango Markets DAO governance discussions on protocol wind-down; community / governance-vote process	(operator response — wind-down)
2025-01-11	Mango Markets announces protocol shutdown; governance proposals to end borrowing and lending operationally effective January 13, 2025	Protocol shutdown completion
2025-05-23	U.S. District Judge Arun Subramanian vacates Eisenberg's criminal conviction on intent-to-defraud / venue grounds; CFTC market-manipulation case unaffected	Criminal conviction vacated → multi-axis attribution shape
Continuing	Civil-litigation fallout and SEC-precedent implications for Solana DeFi token-distribution practices ongoing through 2025-2026	(continuing surface)

What defenders observed

Pre-event (regulatory-posture layer): the SEC's characterisation of MNGO as unregistered securities and Mango's offering activity as unregistered broker activity was foreshadowed by the broader 2021-2024 SEC posture on DeFi-protocol governance tokens. The structural pre-condition was Mango DAO's token-distribution mechanism, which lacked the registration / exemption surfaces that the SEC requires for security-classified offerings. Defender lesson: Solana DeFi protocols with governance-token launches structured outside SEC-recognised registration / exemption frameworks face real regulatory-enforcement risk; defender-tooling for protocol-design discipline should incorporate regulatory-classification analysis as a first-class concern.
At-event (settlement layer): the SEC + CFTC coordinated settlements (September 27, 2024) were structured to permit Mango DAO to wind down operations rather than to require continuing operations under restrictive terms. The settlement required MNGO destruction and delisting; this is a structurally meaningful enforcement outcome that goes beyond civil-penalty-only resolutions. Defender lesson: SEC + CFTC coordinated settlements that require token destruction are a discrete outcome category — the practical effect is protocol shutdown, even where the settlement language does not require it explicitly.
At-event (protocol-shutdown layer): Mango's January 2025 wind-down was operationally orderly — community governance processes were used to set parameter changes that effectively ended borrowing and lending without abrupt user-side disruption. Defender lesson: regulatory-enforcement-induced wind-down can be operationally orderly when the protocol's governance machinery permits parameter-driven shutdown; protocols without such machinery may face less orderly wind-down outcomes if they reach the same enforcement endpoint.
Post-event (criminal-conviction-vacatur layer): Judge Subramanian's May 2025 vacatur of Eisenberg's criminal conviction is structurally informative for the broader DeFi-oracle-manipulation prosecution surface. The vacatur establishes that intent-to-defraud is a structurally narrower element in DeFi prosecution than the prosecution had argued; future DeFi-prosecution surfaces should account for this framing. Defender lesson: criminal-conviction outcomes for DeFi-oracle-manipulation are now structurally uncertain; the CFTC market-manipulation surface remains the more reliable enforcement channel.
Post-event (multi-axis attribution layer): the case produces a multi-axis attribution shape — confirmed-regulatory-enforcement at protocol-side (SEC + CFTC), confirmed-then-vacated-criminal-prosecution at exploiter-side, ongoing CFTC market-manipulation at exploiter-side. Defender lesson: complex DeFi-incident attribution should preserve multi-axis attribution structure rather than collapsing the case into a single attribution-strength label.

What this example tells contributors writing future Technique pages

Regulatory-enforcement-induced protocol shutdown is a discrete defender-relevant outcome category. Future Solana DeFi worked examples should preserve regulatory-enforcement trajectories as a first-class observable, distinct from on-chain-exploit trajectories and from voluntary wind-down trajectories. The Mango Markets case is the canonical 2021-2025 worked example.
Token-distribution regulatory-classification analysis is a first-class defender-tooling layer. Future Solana DeFi protocol-design discipline work should incorporate regulatory-classification analysis as a discrete concern, not as a downstream legal-compliance afterthought. The SEC's posture on MNGO is the v0.1 reference.
Multi-axis attribution shapes are a recurring 2024-2025 corpus pattern. Future contributors writing complex incident attribution should preserve multi-axis attribution structure (regulatory-enforcement at protocol-side + criminal / civil prosecution at actor-side + ongoing parallel proceedings) as a discrete attribution-shape rather than collapsing to a single label.
The Eisenberg conviction-vacatur is precedent-relevant for future DeFi-oracle-manipulation prosecution. Future T9.001 examples involving criminal-prosecution surfaces should reference the May 2025 vacatur as structural precedent; the criminal-prosecution surface is structurally narrower than the regulatory-enforcement and CFTC-market-manipulation surfaces.
The 2024-2025 Mango trajectory is structurally connected to the broader 2021-2024 Solana DeFi token-distribution cohort. Future Solana DeFi cohort coverage should preserve the trajectory — token launch → exploit → governance-recovery → regulatory-enforcement → shutdown — as a discrete cohort observation. Other 2021-2024 Solana DeFi protocols may follow similar trajectories; the cohort coverage should anticipate this.

Public references

[secmango2024] (proposed) — SEC press release 2024-154, "SEC Charges Entities Operating Crypto Asset Trading Platform Mango Markets for Unregistered Offers and Sales of the Platform's 'MNGO' Governance Tokens": https://www.sec.gov/newsroom/press-releases/2024-154
[theblockmango2024shutdown] (proposed) — The Block, "Mango Markets to wind down in wake of SEC settlement, DAO battle": https://www.theblock.co/post/334172/mango-markets-to-wind-down-in-wake-of-sec-settlement-dao-battle
[coindeskmangosec2024] (proposed) — CoinDesk, "Mango Markets Agrees to Destroy MNGO Tokens in SEC Settlement": https://www.coindesk.com/policy/2024/09/27/mango-markets-agrees-to-destroy-mngo-tokens-in-sec-settlement
[bloombergmango2024] (proposed) — Bloomberg, "Mango Markets Is Latest Crypto Project to Settle SEC Charges": https://www.bloomberg.com/news/articles/2024-09-27/mango-markets-is-latest-crypto-project-to-settle-sec-charges
[banklessmangoshutdown2025] (proposed) — Banklesstimes, "Mango Markets Set To Shut Down Following SEC Settlement": https://www.banklesstimes.com/articles/2025/01/13/mango-markets-set-to-shut-down-following-sec-settlement/
[coinmarketcapmango2025] (proposed) — CoinMarketCap Academy, "Mango Markets To Wind Down Operations After $110 Million Exploit and SEC Settlement": https://coinmarketcap.com/academy/article/mango-markets-to-wind-down-operations-after-dollar110-million-exploit-and-sec-settlement
[chaincatchermangoshutdown2025] (proposed) — ChainCatcher, "Mango Markets has reached a settlement with the SEC and will gradually cease operations starting tomorrow": https://www.chaincatcher.com/en/article/2162050
[dailycoinmangoshutdown2024] (proposed) — DailyCoin, "Solana's Mango Markets Shuts Down Amid Ongoing Struggles": https://dailycoin.com/solanas-mango-markets-shuts-down-amid-ongoing-struggles/

Discussion

The Mango Markets 2024-2025 closure is OAK's canonical 2021-2025 worked example for the regulatory-enforcement-induced Solana DeFi protocol shutdown trajectory. The case extends the prior T9.001 / oracle-manipulation coverage at examples/2022-10-mango-markets.md to the regulatory-enforcement-and-shutdown closure layer, and establishes a multi-year trajectory framing that future Solana DeFi cohort coverage should preserve.

The structural distinguishing feature of the case is the multi-axis attribution shape — different parts of the same case produce different attribution-strengths against different actors at different layers. SEC + CFTC settlement against the protocol's token distribution is confirmed; CFTC market-manipulation against Eisenberg is confirmed; criminal conviction against Eisenberg was confirmed from April 2023 to May 2025 and is now vacated-on-intent-grounds. OAK's attribution-strength taxonomy should preserve multi-axis attribution as a discrete shape; the v0.x development should formalise this.

For OAK's broader cohort coverage, this case + the broader 2022-Q4 - 2025 Solana DeFi cohort (Cypher 2023, Crema 2022, Cashio 2022, Wormhole 2022, Slope 2022, Drift 2026 — see examples/2026-04-drift-protocol-durable-nonces-dprk.md) collectively establish that Solana DeFi has matured into a regulatory-enforcement target alongside its on-chain-exploit-target footprint. The two enforcement classes — on-chain attacker prosecution and protocol-side regulatory enforcement — operate on different timescales (months / years for criminal; years for regulatory) and produce different defender-relevant outcomes (asset recovery vs. protocol shutdown). Future Solana DeFi worked examples should preserve both enforcement classes as discrete observables.

The Eisenberg conviction-vacatur (May 23, 2025) is the most precedent-relevant component of the closure. The vacatur narrows the criminal-prosecution surface for DeFi-oracle-manipulation and increases the relative weight of the CFTC market-manipulation surface and the regulatory-enforcement surface against the protocol. Future T9.001 examples involving criminal prosecution should reference the vacatur as structural precedent. At v0.1 cutoff, the vacatur is settled but the broader implications (e.g., prosecutorial response, retrial decisions, appeals) are continuing through 2025-2026.

For OAK's chain-coverage v0.x work, the case strengthens the corpus's coverage of Solana-native DeFi regulatory-enforcement trajectories. The cohort is structurally distinct from EVM-side DeFi regulatory cases (Tornado Cash sanctions, Ooki DAO, Bittrex) because the Solana-side cases involve protocol-side wind-down as a structurally-meaningful settlement outcome; EVM-side cases more frequently produce continuing-operations-with-restrictions outcomes. The structural distinction is informative for defender-tooling discipline and for protocol-design framing on Solana.