$42 Million in Eight Days: Decentralized Exchange Hacks Expose Key Management Risks

Two decentralized perpetuals exchanges on Arbitrum were hacked in August, resulting in losses of $42 million. The attackers compromised private keys held by individuals, which allowed them to manipulate price feeds and drain funds from the platforms.

The first hack occurred at Ostium on July 15, where an attacker used a compromised oracle key to create fake price reports and siphon off $18-23.75 million in liquidity provider funds. Trading was suspended after the attack.

A week later, AFX Trade was hit with a similar attack, which netted the attackers $24.15 million USDC. The platform offered a bounty of 30% to the attacker if they returned the stolen funds, but no return has been confirmed.

The hacks highlight the risks associated with decentralized exchanges, particularly when it comes to key management. While trading on these platforms is secure, the entry and exit points, such as price feeds and custody bridges, are often held by individuals or small groups, making them vulnerable to attacks.