The hacker behind the Mango Markets exploit keeps $47M and returns $67M to the DeFi project after a Mango community vote; he claims all his actions were legal
the exchanges that... 1/2 Bucky Cantor / @buckycantor : If you rob a bank you can't say it's not your fault because the bank was defended poorly. “Code is law” = BS. Hackers should be grateful for mega bug bounties while they last. Law enforcement will eventually catch up and pursue hackers (aka criminals) more effectively. https://twitter.com/... @alfaleek : Where do we draw the line between stealing and taking advantage of bad protocol design? Can this even be considered a hack? https://twitter.com/... @jnptzl : We should have a web3-native court to prevent such exploits. Oh wait, @Kleros_io already did that when the same actor tried to exploit @UnslashedF and @viresfinance. https://twitter.com/... Travis Scher / @travisscher : Protocols have a choice - either post a fair bounty with @immunefi, or subject themselves to later blackmail https://twitter.com/... @drnicka : The mango hacker securing an outsized bounty via DAO governance is a bit of crypto history. https://twitter.com/... Avraham Eisenberg / @avi_eisen : This is similar to how auto deleveraging works on exchanges such as Binance and Bitmex, clawing back some profits from profitable traders in order to ensure all users funds are protected. @pjacaytonphd : The world of crypto and DeFi is a world where people bend their knees to criminal hackers. Because “code is law” in their world. Programmers make for bad legislators. https://twitter.com/... Matt Levine / @matt_levine : i think if you have the latter vision you might think that market manipulation is bad, though i suppose that's not logically required. but if it's a pointless fun game then the manipulation is fine, and fun. Matt Levine / @matt_levine : one vision for crypto is, like, “this is a computer game, and if i can figure out a way to win the computer game that the designers did not intend, then i am cool and clever. also the game pays money.” Matt Levine / @matt_levine : another vision is, like, “we are working to build a new financial system and a new vision of the web.” Leigh Drogen / @ldrogen : Call this whatever you want, but the strategy itself falls directly in the “market manipulation” legal bucket regardless of any ransom deal made with the team I would be highly surprised if the SEC isn't knocking soon https://twitter.com/... Azeem / @azeemk_ : People will really snitch on themselves for clout. Crazy world we live in. https://twitter.com/... Laura Shin / @laurashin : 😮 Curious to know what you all think — is code law or not? Poll below 👇🏻 https://twitter.com/... Fat Man / @fatmanterra : A few months ago, Avi sued a DeFi protocol for unexpected liquidations & restricting access to his funds using price manipulation. Ironically, this is exactly what he did to Mango Market depositors a few days ago. His own old arguments will probably be used against him in court. https://twitter.com/... https://twitter.com/... @oneanalog : 5/ The aftermath - The hacker took to Realms (a Solana community platform) to offer a conditional return of a portion of the funds - Mango's reply, which appears to mostly agree to the hacker's conditions, can be read here: https://dao.mango.markets/...
The BlockOsato Avan-Nomayo
Context & Ripple Effects
Mango Markets had disclosed an oracle price manipulation days earlier, with estimates putting the loss above $100 million. The exploiter then used the protocol’s governance process to seek a waiver of investigations, turning a technical loss into a test of whether DAO voting can settle a disputed extraction.
The community-approved return left Mango with recovered funds but also preserved the central conflict: the actor characterized the trade as legal while critics disputed whether weak protocol design absolves the taker. The later Mango lawsuit seeking the retained $47 million shows that the vote did not resolve that conflict.
First-order effects
Mango Markets recovers $67 million, while the exploiter retains $47 million under the community-vote outcome.
Mango’s community has effectively used its governance process to negotiate a recovery, rather than securing the full proceeds through the protocol itself.
Second-order effects
The retained funds give Mango a concrete incentive to pursue remedies outside DAO governance, a path reflected in its later claim for the $47 million.
Other DeFi protocols face pressure to treat oracle design and governance controls as linked security surfaces: an attacker able to influence both can turn a loss into a negotiated settlement.
Third-order effects
The episode points to a boundary problem for DeFi: programmable execution and token-holder votes may produce an on-chain outcome without establishing whether that outcome is legally final.
If disputes of this kind continue, protocol governance will increasingly operate alongside courts and enforcement rather than as a substitute for them.
The trend: DeFi is confronting the gap between transactions permitted by code and settlements that users, platforms, and legal institutions regard as legitimate.
$67M in various crypto assets have been returned to the DAO. Let's meet up on Monday 3 PM UTC on the Mango discord to discuss, how we can sort out this mess.
I believe all of our actions were legal open market actions, using the protocol as designed, even if the development team did not fully anticipate all the consequences of setting parameters the way they are.
Mango hacker securing himself a ~$47m bug bounty. Biggest crypto bounty by far? The current bounty going rate of 10% of exploited funds is going to need to be repriced lmao. https://twitter.com/...
Working at Robinhood I finally understood how fragile the trading ecosystem is and how much the SEC and FINRA do to root out market manipulation and much more. This just seems daft and is why speculative crypto trading still makes me nervous https://www.theblock.co/...
To remedy the situation, I helped negotiate a settlement agreement with the insurance fund with the goal of making all users whole as soon as possible as well as recapitalizing the exchange.
Unfortunately, the exchange this took place on, Mango Markets, became insolvent as a result, with the insurance fund being insufficient to cover all liquidations. This led to other users being unable to access their funds.
This seems like a pretty sweet deal for the hacker. Most of these “bounties” are roughly 10% of the stolen funds, but this attacker is making off with around 40%. The hacker is also holding on to $116 million in SOL that they can't cash out right now—the exchanges that... 1/2
If you rob a bank you can't say it's not your fault because the bank was defended poorly. “Code is law” = BS. Hackers should be grateful for mega bug bounties while they last. Law enforcement will eventually catch up and pursue hackers (aka criminals) more effectively. https://tw…
We should have a web3-native court to prevent such exploits. Oh wait, @Kleros_io already did that when the same actor tried to exploit @UnslashedF and @viresfinance. https://twitter.com/...
This is similar to how auto deleveraging works on exchanges such as Binance and Bitmex, clawing back some profits from profitable traders in order to ensure all users funds are protected.
The world of crypto and DeFi is a world where people bend their knees to criminal hackers. Because “code is law” in their world. Programmers make for bad legislators. https://twitter.com/...
i think if you have the latter vision you might think that market manipulation is bad, though i suppose that's not logically required. but if it's a pointless fun game then the manipulation is fine, and fun.
one vision for crypto is, like, “this is a computer game, and if i can figure out a way to win the computer game that the designers did not intend, then i am cool and clever. also the game pays money.”
Call this whatever you want, but the strategy itself falls directly in the “market manipulation” legal bucket regardless of any ransom deal made with the team I would be highly surprised if the SEC isn't knocking soon https://twitter.com/...
A few months ago, Avi sued a DeFi protocol for unexpected liquidations & restricting access to his funds using price manipulation. Ironically, this is exactly what he did to Mango Market depositors a few days ago. His own old arguments will probably be used against him in court. …
5/ The aftermath - The hacker took to Realms (a Solana community platform) to offer a conditional return of a portion of the funds - Mango's reply, which appears to mostly agree to the hacker's conditions, can be read here: https://dao.mango.markets/...