Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Currencies39068
Market Cap$ 2.77T-1.12%
24h Spot Volume$ 33.05B+8.19%
DominanceBTC57.10%-0.33%ETH10.91%+0.13%
ETH Gas0.05 Gwei
SecurityDeFiHack
Sep 7, 2026
2min read
byTom Nyarunda
forBlockchainReporter
See what traders are focused on
Rocket paused deposits, withdrawals and trading while it investigates a perpetual-market manipulation that removed about $287,000 from its Bridge. In a security update published Sept. 6, the DeFi platform said the attack occurred at approximately 19:00 UTC on Sept. 5 and involved a market that had been dormant.
The disclosure is Rocket’s preliminary account, not an independent postmortem. It identifies the trading pattern and the amount withdrawn, but it does not name the attacker, publish transaction hashes or establish whether any funds have been frozen.
How the dormant market was manipulated
Rocket said the attacker used a burner account to post orders at artificially inflated prices and then traded against itself. That sequence created what the platform described as fake profit in one account while forcing the disposable account into bankruptcy. The profitable account subsequently withdrew roughly $287,000 in positive profit and loss from the Bridge.
The account suggests a market-control failure rather than a confirmed smart-contract exploit. Thin or inactive markets can be dangerous when an attacker can influence execution prices and use the resulting position value elsewhere in a platform. Rocket said the loss would be socialized, although it has not yet detailed how that calculation will affect individual users.
Trading remains paused during the response
The team said it is working with security firms and law-enforcement agencies. It is also coordinating with exchanges, bridges and stablecoin issuers to trace the assets and seek freezes. Rocket did not identify those counterparties or provide a timetable for restoring deposits, withdrawals or trading.
Other DeFi platforms have also halted functions while tracing losses; a recent Summer.fi incident showed how quickly a targeted exploit can force emergency controls. Rocket’s pause limits further activity while investigators reconstruct the trades, but it also leaves customers unable to use normal platform functions.
Recovery details are still pending
Rocket said it is preparing a recovery plan that would prioritize refunds for smaller accounts. The update did not specify eligibility, payment timing or the retain. The team also warned that it will communicate only through its official account and Discord channels and will not contact users first by direct message
Until Rocket publishes a full technical review, the central unanswered questions are why the inactive market remained exploitable, which controls failed and how the platform will prevent a repeat. Users should treat unsolicited recovery messages as scams and wait for a verified plan.
Source: cryptorank.io