Image credit: Shutterstock
Rocket has paused deposits, withdrawals, and trading after an attacker manipulated a dormant perpetual market and withdrew about $287,000 in artificial profits from the platform.
The incident occurred around 19:00 UTC on September 5. Rocket said the attacker used a disposable account to distort prices and trade against themselves, leaving the resulting loss to be absorbed across the platform.
Attacker Used Self-Trades to Create $287K Artificial Profit
The attack focused on an inactive perpetual market with little trading activity and limited liquidity. Rocket said the attacker placed orders at artificially inflated prices using a burner account, then executed trades between accounts they controlled. One account accumulated artificial profits while the burner account took the corresponding losses and was pushed into bankruptcy.
The profitable account was then able to withdraw roughly $287,000 through Rocket’s Bridge before the activity was stopped. Blockchain security firm SlowMist classified the incident as price manipulation rather than a conventional smart contract exploit. Its incident tracker also puts the loss at $287,000.
$287K Shortfall Was Socialized Across Rocket Platform
Because the losing account could not cover the artificial profit withdrawn by the attacker, Rocket said the shortfall was socialized across the platform.
The project has not disclosed how many users were affected or how losses were allocated among accounts. It is preparing a recovery plan and said smaller affected accounts will receive priority when reimbursements begin.
No reimbursement amount, eligibility criteria or payment timetable has been announced. Rocket has suspended all trading, deposits and withdrawals while its investigation continues. The platform has not given a date for restoring normal operations.
Rocket Seeks Asset Freezes While Tracing Attacker Funds
Rocket said it is working with blockchain security firms and law enforcement while coordinating with exchanges, cross-chain bridges and stablecoin issuers to trace the attacker’s funds and seek freezes where possible.
The project has not disclosed how much of the $287,000 remains traceable or whether any assets have already been frozen or recovered.
Rocket’s recovery plan remains pending, while deposits, withdrawals, and trading remain suspended. The project has not announced when reimbursements will begin or when normal operations will resume.
