Mango Markets, a Solana DeFi platform, says a hacker stole ~$100M by manipulating its coin's price; the hacker made a DAO proposal to waive any investigations
FortuneTaylor Locke
Context & Ripple Effects
Mango Markets had already attributed the loss to an oracle price manipulation, placing the incident at the intersection of market-pricing controls and on-chain lending. The added governance proposal turns the response itself into part of the exploit.
Later coverage shows the Mango community approved an outcome under which the exploiter returned $67M and retained $47M, while Mango’s later token-destruction settlement shows the episode continued to shape the project’s institutional unwinding.
First-order effects
Mango token holders are immediately asked to decide whether the protocol will waive investigation of the alleged theft, making governance participants arbiters of a dispute involving the proposer.
Mango Markets must manage a roughly $100M loss while its own DAO process is being used to seek protection for the party it identifies as the attacker.
Second-order effects
The later community-vote outcome establishes a concrete recovery trade-off for Mango: recovering funds can mean accepting terms that leave part of the proceeds with the exploiter.
Other Solana DeFi protocols face added pressure to treat oracle design and governance voting as connected controls, since a price manipulation can also create leverage over the protocol’s response.
Third-order effects
If this pattern persists, token-holder governance will need clearer limits on proposals involving alleged exploiters, shifting dispute resolution away from ad hoc votes and toward predefined recovery and investigation rules.
Mango’s later move to destroy MNGO tokens and seek an end to exchange trading points to a broader risk: severe governance exploits can evolve from a protocol-security event into a question of whether the token and its surrounding institutions remain viable.
The trend: DeFi is confronting the fact that price-oracle security and token governance are coupled: an attacker able to influence one can seek to shape the remedy through the other.
We are currently investigating an incident where a hacker was able to drain funds from Mango via an oracle price manipulation. We are taking steps to have third parties freeze funds in flight. 1/
Around 22:00 UTC October 11th the 🥭 protocol had an incident involving the following: -2 accounts funded with USDC took an outsized position in MNGO-PERP -Underlying MNGO/USD prices on various exchanges (FTX, Ascendex) experienced a 5-10x price increase in a matter of minutes
So just to recap the @mangomarkets situation: -Hacker exploits Mango for $100M+ -Hacker turns around & offers to return most funds, if DAO promises not to pursue criminal investigations -Hackers uses 32M votes from the exploit to vote ‘Yes’ LMFAO you cannot make this shit up! htt…
It appears the attacker was able to manipulate their Mango collateral. They temporarily spiked up their collateral value, and then took out massive loans from the Mango treasury. https://twitter.com/...
1/ this is how I think the mango attack played out, please let me know if I got anything wrong: at 6:19 PM ET, attacker funded acct A (CQvKS...) with 5mm USDC collateral https://trade.mango.markets/ ... https://twitter.com/... https://twitter.com/...
We will be disabling deposits on the front end as a precaution, and will keep you updated as the situation evolves. If you have any information, please contact blockworks@protonmail.com to discuss a bounty for the return of funds. 2/
We want to clarify and add mention here that neither oracle providers have any fault here. The oracle price reporting worked as it should have. https://twitter.com/...
At a high level, 1. This was not a flashloan attack 2. The attacker addresses were funded 5.5M via FTX 3. It appears the attacker manipulated prices across all exchanges, not just Solana oracles https://twitter.com/...
The attacker created a ~480M MNGO-PERP position and countertraded themself on another account. They then manipulated the price of MNGO up across a number of exchanges, borrowing against their unrealized MNGO gains to drain the protocol. https://twitter.com/...
A lot of hacks in DeFi these days. Manage your risks. Think about worst-case scenarios. Don't put all your eggs in one basket. Stay #SAFU https://t.co/mMQPJLaGRK
Regulatory pressure + risk adjusted returns make DeFi entirely unsuitable for any serious TVL in the short to medium term @mangomarkets are among the best of the best, their tech is art and team are rock solid Yet no person can think of all angles which many think to exploit http…
We have temporarily disabled Mango deposits due to this incident. We are closely following the situation & will keep you updated as soon as there is new info. https://twitter.com/...
This sucks to hear, mango devs are some of the best and they've consistently been one of the highest quality products since early days of solana. Oracles are tricky (kinda like, way more than most people realize) https://twitter.com/...