Moby Trade Private Key Compromised Whitehat Rescue - Revision history

Azoundria at 18:47, 13 February 2025

2025-02-13T18:47:15Z

← Older revision		Revision as of 12:47, 13 February 2025
Line 2:		Line 2:
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Mobytrade.jpg\|thumb\|Moby Trade Logo/Homepage]]Moby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transfer ownership, upgrade the contract, and withdraw funds using the private key. Their execution was very poor, and allowed for anyone to withdraw the funds from the newly upgraded smart contract. While they still took home an impressive amount of loot worth over $1m, an even large portion of funds were withdrawn by a whitehat hacker, who was able to return them to the protocol.<ref name="rektnews-17146" /><ref name="~~arbiscan~~-17147" /><ref name="mobytradetwitter-17148" /><ref name="mobytrademedium-17149" /><ref name="tonykebottwitter-17150" /><ref name="arbiscan-17151" /><ref name="arbiscan-17152" /><ref name="arbiscan-17153" /><ref name="arbiscan-17154" /><ref name="arbiscan-17155" /><ref name="mobytradetwitter-17156" /><ref name="mobytradetwitter-17157" /><ref name="moby-17158" />		[[File:Mobytrade.jpg\|thumb\|Moby Trade Logo/Homepage]]Moby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transfer ownership, upgrade the contract, and withdraw funds using the private key. Their execution was very poor, and allowed for anyone to withdraw the funds from the newly upgraded smart contract. While they still took home an impressive amount of loot worth over $1m, an even large portion of funds were withdrawn by a whitehat hacker, who was able to return them to the protocol.<ref name="rektnews-17146" /><ref name="arbiscanownershiptransfer-17147" /><ref name="mobytradetwitter-17148" /><ref name="mobytrademedium-17149" /><ref name="tonykebottwitter-17150" /><ref name="arbiscan-17151" /><ref name="arbiscan-17152" /><ref name="arbiscan-17153" /><ref name="arbiscan-17154" /><ref name="arbiscan-17155" /><ref name="mobytradetwitter-17156" /><ref name="mobytradetwitter-17157" /><ref name="moby-17158" /><ref name="sepoliatesttransaction-18038" /><ref name="sepoliatransactions-18039" />

	== About Moby Trade ==		== About Moby Trade ==
Line 26:		Line 26:
	!Event		!Event
	!Description		!Description
			\|-
			\|January 8th, 2025 4:56:52 AM MST
			\|Sepolia Testnet Transaction
			\|The hacker starts performing testnet transactions, with a transfer of 4 Sepolia Ethereum.
	\|-		\|-
	\|January 8th, 2025 6:49:28 AM MST		\|January 8th, 2025 6:49:28 AM MST
	\|Ownership Transfer Completed		\|Ownership Transfer Completed
	\|The ownership for the smart contract is ~~transfered~~.		\|The ownership for the smart contract is transferred. Using the stolen Private Key, the attacker executed a Contract Upgrade, changed the Proxy Admin, and transferred Ownership. Consequently, Proxy Admin and Owner privileges were moved.
	\|-		\|-
	\|January 8th, 2025 8:24:05 AM MST		\|January 8th, 2025 8:24:05 AM MST
Line 65:		Line 69:
	\|January 11th, 2025 9:21:52 AM MST		\|January 11th, 2025 9:21:52 AM MST
	\|Post-Mortem Posted on Medium		\|Post-Mortem Posted on Medium
	\|Moby ~~Trade posts~~ a post-mortem on ~~Medium~~.		\|Moby publishes a post-mortem growth plan. Moby’s post-mortem reports details including removal of 3.77 wBTC, 207.76 wETH, and 30,179.79 USDC. While the attack led to the theft of substantial funds, a portion was recovered, and the affected users will be compensated through the Treasury. The root cause was identified as a vulnerability in key management, which the attacker exploited. Following the breach, Moby has initiated an aggressive response, including collaborating with security experts and law enforcement, and has planned to enhance security measures. The team is also working on expanding its platform, including the launch of mobile versions and new financial products.
	\|-		\|-
	\|January 11th, 2025 9:35:00 AM MST		\|January 11th, 2025 9:35:00 AM MST
Line 152:		Line 156:
	<references><ref name="rektnews-17146">[https://rekt.news/mobytrade-rekt/ Rekt - Moby Trade - Rekt] (Accessed Jan 14, 2025)</ref>		<references><ref name="rektnews-17146">[https://rekt.news/mobytrade-rekt/ Rekt - Moby Trade - Rekt] (Accessed Jan 14, 2025)</ref>

	<ref name="~~arbiscan~~-17147">[https://arbiscan.io/tx/0x9da34da770f1e9c5d5e176578b32710d8e288587d8401582f34a9631edf9be4b Arbitrum One Transaction Hash (Txhash) Details \| Arbitrum One] (Accessed Jan 14, 2025)</ref>		<ref name="arbiscanownershiptransfer-17147">[https://arbiscan.io/tx/0x9da34da770f1e9c5d5e176578b32710d8e288587d8401582f34a9631edf9be4b Arbitrum One Transaction Hash (Txhash) Details \| Arbitrum One] (Accessed Jan 14, 2025)</ref>

	<ref name="mobytradetwitter-17148">[https://twitter.com/Moby_trade/status/1877329987323432976 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>		<ref name="mobytradetwitter-17148">[https://twitter.com/Moby_trade/status/1877329987323432976 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>
Line 174:		Line 178:
	<ref name="mobytradetwitter-17157">[https://twitter.com/Moby_trade/status/1879013406302404679 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>		<ref name="mobytradetwitter-17157">[https://twitter.com/Moby_trade/status/1879013406302404679 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>

	<ref name="moby-17158">[https://moby.trade/ https://moby.trade/] (Accessed Jan 14, 2025)</ref></references>		<ref name="moby-17158">[https://moby.trade/ https://moby.trade/] (Accessed Jan 14, 2025)</ref>

			<ref name="sepoliatesttransaction-18038">[https://sepolia.arbiscan.io/tx/0xbf97d408ed11e0161d6667457c3a17b6947bc1b7a339e3201bc1d01c36f0ac78 Arbitrum Sepolia Transaction Hash (Txhash) Details \| Arbitrum Sepolia] (Accessed Feb 13, 2025)</ref>

			<ref name="sepoliatransactions-18039">[https://sepolia.arbiscan.io/address/0x2a566d111d0a5be888fec5f3834434af3245bb1b https://sepolia.arbiscan.io/address/0x2a566d111d0a5be888fec5f3834434af3245bb1b] (Accessed Feb 13, 2025)</ref></references>

Azoundria at 00:55, 16 January 2025

2025-01-16T00:55:51Z

← Older revision		Revision as of 18:55, 15 January 2025
Line 2:		Line 2:
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Mobytrade.jpg\|thumb\|Moby Trade Logo/Homepage]]Moby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transfer ownership, upgrade the contract, and withdraw funds using the private key. Their execution was very poor, and allowed for anyone to withdraw the funds from the newly upgraded smart contract. While they still took home an impressive amount of loot worth over $1m, an even large portion of funds were withdrawn by a whitehat hacker, who was able to return them to the protocol.<ref name="rektnews-17146" /><ref name="arbiscan-17147" /><ref name="mobytradetwitter-17148" /><ref name="mobytrademedium-17149" /><ref name="tonykebottwitter-17150" /><ref name="arbiscan-17151" /><ref name="arbiscan-17152" /><ref name="arbiscan-17153" /><ref name="arbiscan-17154" /><ref name="arbiscan-17155" /><ref name="mobytradetwitter-17156" /><ref name="mobytradetwitter-17157" />		[[File:Mobytrade.jpg\|thumb\|Moby Trade Logo/Homepage]]Moby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transfer ownership, upgrade the contract, and withdraw funds using the private key. Their execution was very poor, and allowed for anyone to withdraw the funds from the newly upgraded smart contract. While they still took home an impressive amount of loot worth over $1m, an even large portion of funds were withdrawn by a whitehat hacker, who was able to return them to the protocol.<ref name="rektnews-17146" /><ref name="arbiscan-17147" /><ref name="mobytradetwitter-17148" /><ref name="mobytrademedium-17149" /><ref name="tonykebottwitter-17150" /><ref name="arbiscan-17151" /><ref name="arbiscan-17152" /><ref name="arbiscan-17153" /><ref name="arbiscan-17154" /><ref name="arbiscan-17155" /><ref name="mobytradetwitter-17156" /><ref name="mobytradetwitter-17157" /><ref name="moby-17158" />

	== About Moby Trade ==		== About Moby Trade ==
Line 113:		Line 113:

	== Ongoing Developments ==		== Ongoing Developments ==

	"As mentioned in our previous post, to protect your assets, please take the following action:		"As mentioned in our previous post, to protect your assets, please take the following action:

Line 173:		Line 172:
	<ref name="mobytradetwitter-17156">[https://twitter.com/Moby_trade/status/1878118611434566063 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>		<ref name="mobytradetwitter-17156">[https://twitter.com/Moby_trade/status/1878118611434566063 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>

	<ref name="mobytradetwitter-17157">[https://twitter.com/Moby_trade/status/1879013406302404679 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref></references>		<ref name="mobytradetwitter-17157">[https://twitter.com/Moby_trade/status/1879013406302404679 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>

			<ref name="moby-17158">[https://moby.trade/ https://moby.trade/] (Accessed Jan 14, 2025)</ref></references>

Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mobytradeprivatekeycompromisedwhitehatrescue.php}} {{Unattributed Sources}} Moby Trade Logo/HomepageMoby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transf..."

2025-01-14T19:16:17Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mobytradeprivatekeycompromisedwhitehatrescue.php}} {{Unattributed Sources}} thumb|Moby Trade Logo/HomepageMoby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transf..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mobytradeprivatekeycompromisedwhitehatrescue.php}}
{{Unattributed Sources}}

[[File:Mobytrade.jpg|thumb|Moby Trade Logo/Homepage]]Moby Trade is a decentralized options trading protocol designed to provide high liquidity and risk-hedging strategies. On January 8th, the private key behind multiple smart contracts was compromised. Over the course of a few hours, exploiters managed to transfer ownership, upgrade the contract, and withdraw funds using the private key. Their execution was very poor, and allowed for anyone to withdraw the funds from the newly upgraded smart contract. While they still took home an impressive amount of loot worth over $1m, an even large portion of funds were withdrawn by a whitehat hacker, who was able to return them to the protocol.<ref name="rektnews-17146" /><ref name="arbiscan-17147" /><ref name="mobytradetwitter-17148" /><ref name="mobytrademedium-17149" /><ref name="tonykebottwitter-17150" /><ref name="arbiscan-17151" /><ref name="arbiscan-17152" /><ref name="arbiscan-17153" /><ref name="arbiscan-17154" /><ref name="arbiscan-17155" /><ref name="mobytradetwitter-17156" /><ref name="mobytradetwitter-17157" />

== About Moby Trade ==
Moby Trade is a decentralized options trading protocol designed to offer unparalleled liquidity and leverage, providing users with the ability to trade options with up to 1000x leverage without liquidation risks. The platform features narrow spreads and a risk-hedging algorithm that ensures safety while offering attractive returns. Moby aims to create an options exchange that can fill hundreds of order books using real-time market data, making it a highly efficient trading platform in the decentralized finance (DeFi) space.

The protocol offers various opportunities for liquidity providers (LPs) with options pools of differing risks and returns. Short-term options LPs face high risk but potentially high returns, while mid-term options LPs have a more balanced risk-to-return ratio. Long-term options LPs, which are expected to be launched soon, will focus on low-risk and low-return options. Moby's APR is designed to stand out, offering lucrative returns while maintaining security through its risk-hedging mechanisms.

Moby is backed by the Arbitrum Foundation and supported by major security audits from firms like Hacken, PeckShield, and Omniscia. It operates across multiple blockchains, enhancing its accessibility and ensuring liquidity. The protocol has established strong partnerships with notable players in the DeFi space, including GMX, Blocksholes, and GSR. In terms of statistics, Moby has facilitated over $3.5 billion in total trading volume and $17.6 million in transaction volume, with a net revenue of approximately $615,588, positioning itself as a major player in the DeFi options market.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"An attacker gained control of an Admin-privileged Private Key, compromising key smart contracts."
{| class="wikitable"
|+Key Event Timeline - Moby Trade Private Key Compromised Whitehat Rescue
!Date
!Event
!Description
|-
|January 8th, 2025 6:49:28 AM MST
|Ownership Transfer Completed
|The ownership for the smart contract is transfered.
|-
|January 8th, 2025 8:24:05 AM MST
|S Vault Emptied of USDC
|The s vault is emptied of 30,179.97232 USDC by the exploiter.
|-
|January 8th, 2025 8:25:41 AM MST
|S Vault Emptied of Bitcoin
|The s vault is emptied of 0.07410301 wrapped bitcoin by the exploiter.
|-
|January 8th, 2025 8:28:30 AM MST
|S Vault Emptied of Ethereum
|The s vault is emptied of 0.786587707271363676 wrapped ethereum by the exploiter.
|-
|January 8th, 2025 9:47:06 AM MST
|M Vault Emptied of Ethereum
|The m vault is emptied of 206.975670722296862975 wrapped ethereum by the exploiter.
|-
|January 8th, 2025 9:47:31 AM MST
|M Vault Emptied of Bitcoin
|The m vault is emptied of 3.70117335 wrapped bitcoin by the exploiter.
|-
|January 8th, 2025 9:48:05 AM MST
|Whitehat Rescue Transaction
|A whitehat rescue transaction is performed by SEAL911. This operation appears to recover the USDC, but not the wrapped bitcoin or wrapped ethereum.
|-
|January 8th, 2025 11:27:00 PM MST
|SEAL911 Post About Hack
|tonykebot from the SEAL911 team posts an announcement about the whitehat operation, highlighting that they were 30 seconds too late to save the Wrapped Ethereum and Wrapped Bitcoin.
|-
|January 9th, 2025 5:22:00 AM MST
|Recent Incident Report Made
|Moby Trade posts an "Important Update: Regarding Recent Incident".
|-
|January 11th, 2025 9:21:52 AM MST
|Post-Mortem Posted on Medium
|Moby Trade posts a post-mortem on Medium.
|-
|January 11th, 2025 9:35:00 AM MST
|Reminder To Revoke Approvals
|Moby Trade posts another update reminding users to revoke their approvals on revoke.cash.
|}

== Technical Details ==
"An attacker gained control of an Admin-privileged Private Key, compromising key smart contracts."

== Total Amount Lost ==
"The attacker managed to steal assets from the Vault:
• 3.774 WBTC
• 207.78 WETH
• 30,180 USDC"

The total amount lost has been estimated at $2,473,000 USD.

== Immediate Reactions ==
"On January 8, 2025, Moby experienced a security situation involving the compromise of an admin private key. We deeply apologize for this lapse in key management and want to assure you we are working tirelessly to recover the protocol and secure user assets.

Thanks to the support of the SEAL911 team, we recovered 1,470,191 USDC that was at risk.

What happens to your funds?
• OLP depositors: Your assets are safe. You’ll be able to withdraw all deposits as soon as the system is back to normal. Withdrawals will be funded by the team treasury.
• Options traders:
1) For expired options, compensation will reflect the most favorable value during downtime.
2) For unexpired options, positions will remain intact and returned as they are.

We are working with top security experts and relevant national authorities to track and recover the stolen funds. We are also reaching out to the attacker via on-chain messages and will share updates if there is a response.

The reopening of the protocol, originally scheduled for January 9 at 1 PM UTC, will be delayed to ensure a thorough investigation. We will provide a revised timeline soon.

A detailed post-mortem report, including next steps to improve security, will be shared with the community as soon as it’s ready."

== Ultimate Outcome ==
"As we've mentioned on our Post-Mortem Report, compensation for expired options has been completed. The restoration of active, non-expired options will be recovered as soon as the platform is stabilized. The compensation has been distributed exclusively to users who revoked compromised contracts on Arbitrum to prevent further drains by the attacker. Users who revoke these contracts after this announcement will also be identified and compensated accordingly.

Now we are actively collaborating with top-tier security firms to track attacker's on-chain actions in real time. When attacker accounts are identified on exchanges, we'll take immediate steps to freeze them. Alongside legal authorities, we are also maintaining open communication with the attacker to recover stolen assets and expedite the restoration of platform operations.

We understand the gravity of this situation and are fully committed to resolving this matter as quickly and securely as possible to ensure the trustworthiness and stability of Moby."

== Total Amount Recovered ==
"OLP depositors could withdraw their deposits once systems normalized, funded by the team treasury, while options traders would see their positions either compensated at "most favorable value" or returned intact."

The total amount recovered has been estimated at $1,470,000 USD.

== Ongoing Developments ==

"As mentioned in our previous post, to protect your assets, please take the following action:

Revoke any active approvals associated with the following addresses...

• PositionManager: 0xB03E14Eeb1a4B2F95a7e1CBe400BAec3E78d2a1F
• SettleManager: 0xA62027C5edc68Abc52D3a3BbDd213Fa12457320B
• sRewardRouterV2: 0x64e1faFA9e9d5F1a7431B886F5Fbff4052c5925d
• mRewardRouterV2: 0x6881E756EA3322AEAadE0267C2a7FcF2A887ee9A
• Controller: 0x46FA90cAbeCeA5369F5Ca9466655277EcA36b574

Thank you for your understanding and trust. Moby is committed to ensuring the safety and security of your assets."

"We’ve been reminding users through our official channels and reaching out directly in other ways.

However, it seems some users haven’t taken action or missed our messages.

To help protect everyone’s assets, we’re sharing this reminder again.

To protect your assets, please revoke all active approvals related to Moby contracts on Arbitrum immediately...

We sincerely apologize once again for any inconvenience and concern this may have caused."
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-17146">[https://rekt.news/mobytrade-rekt/ Rekt - Moby Trade - Rekt] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17147">[https://arbiscan.io/tx/0x9da34da770f1e9c5d5e176578b32710d8e288587d8401582f34a9631edf9be4b Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="mobytradetwitter-17148">[https://twitter.com/Moby_trade/status/1877329987323432976 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>

<ref name="mobytrademedium-17149">[https://medium.com/moby-trade/moby-post-mortem-report-growth-plan-504ad5b0dd35 Moby Post Mortem Report Growth Plan] (Accessed Jan 14, 2025)</ref>

<ref name="tonykebottwitter-17150">[https://twitter.com/tonykebot/status/1877240684266295373 @tonykebot Twitter] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17151">[https://arbiscan.io/tx/0x78b8900134bb345c16694096a43532d513dffdbeb3f7e154ac280377c35351b8 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17152">[https://arbiscan.io/tx/0x39e21d38087de0d31a3e6bdae42c2431211c3773ca8ea96956062de393dfa291 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17153">[https://arbiscan.io/tx/0xfb260f58332034fe203a41b031c41b8461f469e46d5632b33b328f22aed1fb42 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17154">[https://arbiscan.io/tx/0xa64829baf5b83fb6fbebcac334f2c73f6d8ec31a4c8b210538e32105c8ca8566 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="arbiscan-17155">[https://arbiscan.io/tx/0x15890f9b4db381875d2e1e606f5c0b39540295f2af7ab34abe4dd4722dde18d2 Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Jan 14, 2025)</ref>

<ref name="mobytradetwitter-17156">[https://twitter.com/Moby_trade/status/1878118611434566063 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref>

<ref name="mobytradetwitter-17157">[https://twitter.com/Moby_trade/status/1879013406302404679 @Moby_trade Twitter] (Accessed Jan 14, 2025)</ref></references>