Hamster retweetledi
Yesterday afternoon, Cascade detected a security exploit affecting our CLS vault, resulting in the loss of $1.3M in user funds. All trading and withdrawals were paused accordingly.
This is what we know:
1. On thin liquidity markets, most of the orderbook orders were created by CLS
2. Attackers started accumulating long positions where CLS held the short side of the trade
3. Mark price was artificially manipulated upwards, thereby triggering liquidations/close-outs for CLS. Since the attackers held the other side of the trade, the attackers' positions were ADL-ed and closed at the high mark price.
4. These liquidations amounted to approximately $1.34M and these funds were immediately withdrawn.
This is the TX: arbiscan.io/tx/0xcd801d24e…
5. There were two attacker account emails used on Cascade relating to the individual pertinent trades: Ivan Isver (isverivan@gmail.com) &
Maksim Petrenko (mptrnk@gmail.com).
Any pertinent information on these users would be helpful towards our active investigation.
What we are currently doing:
1. We are still investigating the actual mark price manipulation mechanism.
2. We have built out the attackers’ invitation chain on Cascade, and SEAL 911 has helped trace their on-chain activity to Polymarket and Binance. SEAL has also flagged the theft wallets with CEXs.
3. We’re also in active contact with law enforcement and are reporting everything to them as we uncover more details.
4. We’ve contacted the origin of the attackers' invite chain for additional information. These have also been disclosed to LE.
5. Some users have also reported seeing erroneous zero trading balances. This is being resolved as well.
Appreciate those who reached out with additional information. Please continue to report any findings to us so that we can flag these to SEAL 911 and LE entities.
Feel free to reach out to @SEAL_911 with any additional information as well.
English
