Rocket has suspended deposits, withdrawals and trading after an attacker manipulated an inactive perpetual market and withdrew about $287,000 from the platform’s Bridge.
According to a Sept. 7 update from the project, the incident took place at roughly 19:00 UTC on Sept. 5. Rocket said the attacker used a burner account to create artificial profits through inflated orders and self-trading, then extracted the gains before the activity was stopped.
How the attack worked
Rocket’s description of the incident did not point to a smart contract exploit. Instead, the team said the attacker targeted a thinly traded perpetual market with little activity, making it easier to distort pricing and position outcomes.
Using a disposable account, the attacker reportedly placed orders at artificially high prices and traded against themselves. Rocket said that process created “fake profits” in one account while the burner account took the matching losses and eventually became insolvent.
The account showing positive profit and loss then withdrew approximately $287,000 through the Bridge. Rocket said the resulting loss was socialized across the platform.
Operations paused as investigation begins
Following the incident, Rocket halted all trading, deposits and withdrawals while it investigates. The project has not said when those services might be restored, and it has not disclosed how many users were affected by the socialized loss.
Blockchain security tracker SlowMist categorized the case as a price manipulation attack and also listed the loss at $287,000. The approach resembles earlier incidents in low-liquidity perpetual markets, where traders were able to distort prices or positions and shift losses elsewhere in a platform.
Recovery effort focuses on tracing funds
Rocket said it is working with security firms and law enforcement agencies to investigate what happened and try to recover the stolen assets. The team is also coordinating with cryptocurrency exchanges, bridges and stablecoin issuers to trace the funds and seek freezes where possible.
So far, Rocket has not named the security companies or law enforcement bodies involved. It also has not said whether any of the withdrawn funds have been frozen or recovered.
Compensation plan still being prepared
The platform said it is developing a recovery plan for affected users, with smaller accounts set to receive priority when refunds begin. However, Rocket has not yet provided details on the size of any recovery pool, who will qualify, how payments will be made or when reimbursements could start.
Rocket said compensation is the main issue affected users want addressed, but added that it will share specifics only when it can do so responsibly. The project has not announced any bounty or direct offer to the attacker, and its current response remains centered on fund tracing and reimbursement planning.
As a next step, Rocket said official recovery information will be posted only through its X account and Discord channels. The team also warned users to be alert for impersonators and said staff will not initiate contact with affected users through direct messages.
Source: crypto.news