Mango Markets Exploit Plot Revealed

A group claiming responsibility for removing $112 million from Mango Markets last week called it a “highly profitable trading strategy”

article-image

Source: Shutterstock

share

key takeaways

  • Avraham Eisenberg, claiming to be part of the group that exploited Mango, said the protocol’s designed left it vulnerable
  • The Mango team says it is in the process of recouping a portion of the funds, though no definitive timeline has been given

A self-described “digital art dealer” claiming to be part of a group that siphoned $112 million from Mango Markets last week has come forward to defend the group’s actions.

In a statement on Twitter, Avraham Eisenberg said the group used the protocol “as designed,” believing their actions to be legal. The development team failed to anticipate the consequences of the protocol’s parameters, he said.

The attack rocked the Solana-based trading platform on Tuesday, sending the price of its native token, MNGO to roughly $0.02, down around 50% on the day, and off 95% from an all-time peak of $0.50 set in September 2021. 

The wallet receiving funds drained from the protocol had proposed via a DAO community vote on Saturday to return a portion of the proceeds less a substantial bounty, if the community promised not to pursue legal action. That proposal was soundly defeated.

Mango’s developers tweeted they are now in the process of recouping $67 million in various cryptoassets and said the team has started working on an algorithm to decide on a refund split.

Loading Tweet..

Eisenberg was initially linked to the wallet address that carried out the exploit via an ENS domain name ponzishorter.eth and anonymous Discord chat messages published by Chris Brunet that indicated the moniker was used by Eisenberg. The chat logs also showed Eisenberg discussing the precise mechanism of the exploit in advance.

Was the Mango Markets exploit a crime?

Since the attack, a debate has raged on crypto Twitter as to whether those responsible could be subject to civil or even criminal liability.

According to Doug Colkitt, founder of the Crocswap decentralized exchange, the group’s actions don’t rise to the level of “computer fraud.”

Loading Tweet..

Despite the significant funds removed from the protocol, legal prosecution is unlikely, according to Ian Corp, an attorney at law firm Agentis.

“It’s possible that the SEC and/or CFTC bring civil charges against them,” Corp told Blockworks via email, “but they would have to also prove that the Mango token was either a security or commodity.”

So far, there are few precedents for prosecuting this type of DeFi market manipulation.

“Celsius and Three Arrows engaged in obvious market manipulation and no government agency have come forward to punish them accordingly,” Corp said.

Blockworks Research analyst Dan Smith also drew a distinction between the facts in this case compared to other exploits.

“The exploiter only used open market operations to pull this off. No code was changed, no new code was deployed, and he did not have to manipulate anyone else into acting on his behalf,” Smith said. 

But the case bears some similarities to the exploit that took down Indexed Finance in December 2021. Founders of the protocol identified the attacker, and their resulting lawsuit is pending in Canadian courts.

A further proposal to deal with the DAO’s bad debt passed a community vote and is expected to be discussed on Mango’s Discord on Monday.

Macauley Peterson contributed reporting.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates.png

Research

Ethena Labs is leaping from its flagship synthetic dollar, USDe, to a full product suite—USDtb, iUSDe, and the Arbitrum-based Converge Chain—designed to marry crypto-native yields with TradFi-grade compliance. Our analysis shows how expanding into CME, ETF options, and tokenized Treasuries could lift protocol revenue from sub-$500 million in a bear case to several billion dollars if favorable regulation and institutional adoption align.

article-image

CEO Mike Silagadze tells Blockworks that the US is “open for business” and why its DeFi bank offering is the first of many

article-image

Doing one thing well and leaving everything else out is often what disruptive technologies do best

article-image

Why an analyst is kicking off COIN coverage with “buy” rating

article-image

“Bitcoin does not require a strong equity rally to move higher,” YouHodler markets chief Ruslan Lienkha said

article-image

President Trump’s comments that he will not look to fire Fed Chair Jerome Powell sent stocks higher in after-hours trading Tuesday