Thread by @Tristan0x

1. Quick breakdown of what happened today on @mangomarkets, the movement of exploited funds and who might be responsible.

2. For background, the exploit involved an oracle price manipulation attack on the $MNGO market.

Covered in great detail here:

https://twitter.com/joshua_j_lim/status/1579987648546246658

3. TLDR;
Attacker pumped the price of the illiquid $MNGO token from 3c to 91c. The unrealised PnL (marked at >$400M) of positions were in turn able to be used as collateral on @mangomarkets to borrow all assets on the platform and leave it in deficit.

4. Tracing the flow of funds 🔁

On October 11, 2022 19:43 the exploiter `yUJw` funded their account with a total $5.5M USDC from @FTX_Official

5. After executing the aforementioned attack, they were able to withdraw roughly $116M of assets.

The $USDC was withdrawn to `41zC`, $USDT to `5C1k`, $MNGO mostly used to launch a sham DAO governance vote and the remaining assets left untouched in the wallet.

6. Following the trail of USDC, we see that 57M lands in a @circlepay wallet `41zC` (confirmed by multiple sources + users of circle).

7. Of the cumulative ~57M going into `41zC` we can hazard a guess that ~27M of those are moved to Circle's main wallet `7VHU` (containing over 3B USDC).

We're still unsure as to whether this is an attempted redemption for fiat, only @circlepay can really shed light here.

8. So what happened to the other ~30M?

This seems to still reside in the `41zC` wallet. Our guess is this is wallet is used to custody funds for bridging on Circle's newly launched Cross-Chain Transfer Protocol.

circle.com/en/pressroom/c…

9. Why do we think this?

Well as it happens, 30M USDC was redeemed on Ethereum starting at 23:16:35, whilst Solana USDC deposits we saw above to their Circle deposit wallet `2NTz` began at 23:14:54. It was then swapped to DAI via 1inch.

2mins apart, quite the coincidence no?

10. To make this case even more concrete, the Ethereum address to which it's withdrawn to are under "ponzishorter.eth" ENS domain.

etherscan.io/address/0xadba…

11. Who is ponzishorter.eth?

A few days prior to this exploit, a certain discord user was discussing details of a potential oracle manipulation exploit proof of concept on the order of 9 figures. Eerily similar.

Massive kudos to @realChrisBrunet for discovering this info.

12. Thanks to inside sources it turns out his real identity is Avraham Eisenberg and he's got quite a coloured history with respect to hacks and crypto exploits.

13. Most recently he rugged to the tune of 10M on his OHM fork project Fortress DAO.

@zachxbt and others cover this below:

https://twitter.com/zachxbt/status/1532124049282826241?s=21

rattibha.com/thread/1491089…

14. Now it's down to @FTX_Official and @circlepay who have the KYC information to show undeniable evidence (unless the accounts are stolen or KYC docs faked).

Deposit from FTX: solana.fm/tx/4aPwYv5fKGK…
Exploiter's Circle deposit address: solana.fm/address/2NTz7V…

15. Truly hope that all funds are returned to users who lost money today.

Likewise, hoping the undeniably excellent @mangomarkets team bounce back from this quickly - DeFi needs more smart and dedicated teams like them.

16. Kudos to @0xFA2, @zachxbt and many other anons who helped piece together some of the clues and trawl through on-chain txes all day.

17. Looks like this is not his first rodeo either. He's pulled same old trick before as @wilburforce_ highlights:

https://twitter.com/wilburforce_/status/1580219914773991425?s=20&t=oeZb4Q7AOMy5p-foj8hVjw