How much was lost in the Mango Markets hack?

$116M Oracle Manipulation, as publicly reported (October 11, 2022).

Who was behind the Mango Markets hack?

Publicly attributed to Avraham Eisenberg (arrested). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Mango Markets

Mango Markets Hack: $116M Oracle Manipulation

Q: How was the Mango Markets hack carried out?

Oracle Price Manipulation. Eisenberg opened two large opposing MNGO-PERP positions across two wallets he controlled. By aggressively buying MNGO spot on thin markets (FTX, AscendEx), he pumped the oracle price from $0.038 to $0.91 — a 23× spike — within 30 minutes. This inflated his long position's unrealized P&L to over $423M.

October 11, 2022 · Solana · Avraham Eisenberg (arrested)

drained

$116M

returned (deal)

$47M

price pump

10×

core exploit

1 tx

What happened

On October 11, 2022, Mango Markets — a decentralized trading platform on Solana — lost $116M in one of the most brazen and legally unprecedented DeFi exploits. Trader and self-described 'applied game theorist' Avraham Eisenberg openly admitted to and planned the attack: he artificially pumped the price of Mango's native MNGO token by 10× using two accounts he controlled, inflated his collateral value to $423M on paper, and borrowed all available liquidity from the protocol. He then negotiated a $47M governance-approved settlement — framing it as a 'whitehat' rescue — before being arrested by the FBI in December 2022 and convicted in April 2024.

How the funds moved

Step 1

Oracle Price Manipulation

Eisenberg opened two large opposing MNGO-PERP positions across two wallets he controlled. By aggressively buying MNGO spot on thin markets (FTX, AscendEx), he pumped the oracle price from $0.038 to $0.91 — a 23× spike — within 30 minutes. This inflated his long position's unrealized P&L to over $423M.

Step 2

Mass Borrow Against Inflated Collateral

With $423M in phantom collateral, Eisenberg's account borrowed every liquid asset from Mango Markets: $116M in USDC, SOL, BTC, and other tokens. Mango's treasury and user deposits were fully drained. The inflated MNGO price then collapsed after the borrow, making the collateral worthless.

Step 3

Governance Negotiation and Partial Return

Rather than flee, Eisenberg negotiated publicly via governance vote: he would return $47M to cover bad debt if the protocol agreed not to pursue legal action and waive the remaining $69M as his 'profit'. The governance vote passed. He returned $47M but was arrested by FBI in December 2022 regardless.

Key findings

Identified Attacker

Avraham Eisenberg — publicly confessedEisenberg published a Twitter thread hours after the exploit claiming it was 'legal' under the protocol's rules. Arrested by FBI in Puerto Rico, December 2022. Convicted April 2024.

ArrestedConvicted

Attack Mechanism

Oracle manipulation via thin Solana spot marketsMNGO spot markets on FTX and AscendEx had <$1M in liquidity. Pumping spot price moved Mango's TWAP oracle, inflating on-chain collateral value by 23×. No smart contract bug — pure economic exploit.

Oracle Manipulation

Partial Recovery via Governance

$47M returned — $69M keptEisenberg claimed governance approval constituted a legal agreement. Courts disagreed: he was convicted of commodities fraud and market manipulation. The $69M he retained was forfeited as part of criminal proceedings.

Chain

Solana — first major DeFi exploit on-chainMango Markets ran on Solana's SPL token standard. The exploit demonstrated that economic oracle attacks — not EVM-specific — are possible on any chain with thin liquidity and TWAP oracle dependencies.

Solana

Investigate your own incident

ChainHint traced the Mango Markets hack in minutes.
Use the same tool for your case.