Perp DEX Hacks Raise Questions About Decentralisation and Key Management

In July, two decentralised perpetuals exchanges on Arbitrum were hacked, resulting in losses of approximately $42 million. The attacks took place within eight days, with Ostium being emptied on July 15 and AFX Trade on July 22.

The entry point for the attackers was not a smart contract but rather private keys held by individuals. This raises questions about the decentralised nature of these exchanges, as many providers keep their deposit bridges' signing keys on servers that users are unaware of.

One of the attacks involved compromising a price oracle's private key at Ostium, allowing the attacker to open a position at a fabricated Bitcoin price and close it at the actual price. The difference came out of the liquidity providers' vault, resulting in losses ranging from $18 million to $23.75 million.

The other attack targeted AFX Trade, where an attacker gained control of the validator signing keys for the USDC custody bridge. This resulted in $24.15 million USDC being withdrawn and swapped into ETH, leaving the platform's total value locked effectively empty.