🌎 Attacker to Return $7.6M to Rho Markets After Configuration Error

Blockchain investigator ZachXBT has reported that the attacker responsible for taking funds from the Scroll-supported lending protocol Rho Markets is ready to return the funds. The attacker has communicated an on-chain message stating their intention to return the funds, emphasizing that the incident was not an exploit or hack.

Following the incident, ZachXBT observed that the attacker seemed to be a grey or white hat, suggesting that the funds could be recovered. The attacker has significant exposure on centralized exchanges, which ZachXBT highlighted.

Shortly after, the attacker sent an on-chain message to Rho Markets. The message stated:

“Our MEV bot has profited from a configuration error in Rho Markets’ price oracle. We understand these funds belong to users and are willing to return them in full. However, we first want you to acknowledge that this was not an exploit or hack, but a configuration mistake on your part. Additionally, please inform us of the measures you will take to prevent such incidents in the future.”

Rho Markets Pauses Platform Amid Investigation

Earlier, blockchain security firm Cyvers Alerts reported that Rho Markets had experienced an attack that affected the protocol’s USDC and USDT pools. The attacker managed to move $7.6 million in user funds, distributing these across several chains.

Rho Markets and Scroll, an Ethereum Layer 2 protocol, confirmed the attack, noting “unusual activity.” As the investigation commenced, the Rho Markets team announced a pause to the network’s functions.