Perpetuals platform Rocket has paused all deposits, withdrawals, and trading after an attacker extracted approximately $287,000 through a market-manipulation attack on a dormant perpetual market — a loss the platform says will be socialized across its user base.
The Mechanics
In a September 5 statement, the Rocket Foundation said that at approximately 19:00 UTC an attacker exploited a dormant perpetual market on the platform. Using a burner account, they posted orders at artificially inflated prices and traded against themselves, generating fake profits on one account while bankrupting the burner. The profitable account then withdrew roughly $287,000 in positive PnL from the platform's Bridge contract, leaving the resulting deficit to be absorbed by the platform as a whole.
SlowMist's incident tracker classifies the case as price manipulation. The pattern is a close cousin of the Mango Markets attack class that resurfaced this year in the Tectonic incident on Cronos: thin or dormant markets whose price can be set by a single determined trader, then monetized wherever the platform trusts that price — collateral valuations, PnL settlement, or both. No code needs to break for this to work; the market itself is the vulnerability.
The Response
Rocket said it is working with security firms and law enforcement, and coordinating with exchanges, bridges, and stablecoin issuers to trace and freeze the stolen funds. For affected users, the team said it is preparing a recovery plan that starts with refunds for smaller accounts, with specifics to be shared "as soon as we responsibly can." The platform also warned users that it communicates only through its official account and Discord channels, and that anyone direct-messaging users about recovery is a scammer — a standard but necessary caution, since incident-driven phishing reliably follows public breach announcements.
The Lesson, Again
Dormant markets are not neutral dead weight on a venue's books; they are live attack surface. Every listed market whose price feeds a settlement mechanism is a promise that the price means something, and an attacker only needs one where nobody is looking. The $287,000 here is small by the year's standards — the same weekend, Liquid Network lost roughly 4,000 BTC to a sidechain software bug — but the mechanics are more preventable than most: markets that no longer attract organic volume either get delisted or get defenses. Socialized losses are what happens when neither choice is made in time.
TrustGrade tracks the security posture of DeFi protocols and trading venues. Security scans with verified, registry-backed scores arrive with TrustGrade Code Scoring in December 2026.