DYdX, a leading decentralized perpetuals exchange, announced it has engaged law enforcement after uncovering the identity of the perpetrator behind alleged market manipulation attacks that transpired in Q4 2023.

In a Jan. 3 postmortem of the attacks, dYdX said it is in communication with the attacker and is assisting in an ongoing investigation into the incident being carried out by law enforcement.

“Thanks to the efforts of our team, partners in the community, and forensics contractors, investigative results have uncovered the identity of the attacker and we are in contract with them,” dYdX said. “DYdX is assisting law enforcement in their investigation of this matter and is assessing all legal options. DYdX is committed to taking any legal action it deems appropriate in these circumstances.”

The post also outlines measures taken by the dYdX protocol to protect against future incidents. These include revising the margin thresholds available for “less-liquid” markets, expanding monitoring tracking the open interest of active positions, and restrictions on users’ ability to withdraw unrealized profits in the event of “abnormal activity” on the platform.

“These measures will impede other bad actors from trying to use the same strategy to take levered position, manipulate spot prices, withdraw against mark-to-market gains, and repeat,” dYdX asserted.

However, dYdX’s handling of the incident has attracted criticism from its rivals, who decry the project for resorting to centralized tactics.

Adam Cochran, a councilor to Synthetix, the prominent decentralized derivatives protocol, lambasted the measures taken by dYdX in response to the incidents.

“DYdX has in the past 24 hours: auto de-leveraged profitable traders closing their trades, [and] threatened to sue traders for losses incurred from their bad param[eter]s,” Cochran said. “If you just buy up an asset that’s illiquid then a lot of jurisdictions don’t consider that to be a problem… really, the onus is on the system here.”

A French court recently dismissed charges against the perpetrator behind an exploit targeting Platypus Finance, deeming they interacted with publicly available smart contracts according to how they were written.

“Pretty impressive [dYdX[ are able to replicate all of these centralized exchange strategies while being decentralized,” tweeted Kain Warwick, the founder of Synthetix.

Market manipulation

According to the team, dYdX v3 suffered two separate market manipulation attacks in October and November.

The first incident targeted dYdX’s SUSHI market between Oct. 29 and Nov. 3. The attacker deposited $5.3M and took out several 5X leveraged long positions that resulted in the token’s price spiking by 180%. As the price jumped, the malicious actor withdrew unrealized profits from their position, which were then used to open additional leveraged long positions.

The dYdX team took note of the attack and increased the margin requirement for its SUSHI/USD market to 100%, forcing the attacker to close their position — pocketing a $5M profit in the process.

Using the profits realized from the SUSHI attack, the attacker then set their eyes on YFI. The malicious trader sought to replicate the same strategy, opening sizable 5X long positions before funneling unrealized profits into new long positions as YFI’s price increased. YFI soared 215% from $6,500 to $14,000.

On Nov. 17, dYdX again responded by increasing margin requirements for YFI, resulting in the token’s price plummeting over the following day. With YFI comprising a largely illiquid market, the attacker was unable to close their position before the crash and the majority of their positions were liquidated.

On Nov. 18, Anotonio Juliano, the founder of dYdX, announced that $9M had been mobilized from the project’s insurance fund to cover shortfalls caused by the violent YFI liquidations.