A Week of Exploits.

All research is powered by Kaiko data.

Trend of the Week

A week of exploits.

Abracadabra, the protocol responsible for the MIM stablecoin, was exploited last week. The attacker made off with about $7mn MIM – quickly sold off for ETH – after exploiting a vulnerability in Abracadabra’s lending dapp, Degenbox. As of this writing, MIM remains depegged due to the selling, at around $0.99.

The graph above shows all transfers of MIM on Ethereum from the day before the exploit until the day after. The thicker lines between the exploiter, the exploit contract, Degenbox, and Bentobox (Sushi’s lending dapp) show how the attacker used flash loans of MIM from Degenbox, sent the MIM to Bentobox, and repeated the process to drain the former of MIM via two “Cauldrons”, or lending markets.

Next, we can see flows from the contracts to DEXs as the attacker sold off MIM for ETH, primarily using the Curve MIM-3pool (DAI/USDT/USDC) pool. On the left, there are large flows between the multisig and treasury as the team announced that it would be using treasury funds to buy MIM in an attempt to restore its peg. At the bottom left, there were also significant flows between MIM’s LayerZero integration address – essentially allowing the token to be used on multiple chains – and a wallet that we have previously covered, which appears to be engaged in arbitrage.

Elsewhere, in a hack with a much simpler on-chain footprint, Ripple’s co-founder was hacked for over 200mn XRP, with the tokens sent to a variety of exchanges over the course of a few hours. The first came around 11am UTC and the last at 10pm.

Between the first and last transaction, CVD – a measure of net buying and selling – showed a net sell off of nearly 100mn XRP, primarily on Binance and OKX. The hack didn’t become public knowledge until a few hours later, following a tweet from ZachXBT. While many stolen tokens seem to have been sold, the attacker was not able to sell all of the tokens before their accounts were frozen.

— Continues Below —

Data Points

Jupiter completes one of the largest airdrops ever.

Last week, Solana DEX aggregator Jupiter airdropped its 1 billion JUP tokens – about $700mn at post-launch prices – to users who had qualified. While some users did have issues claiming tokens for various technical reasons, the Solana network had no downtime, a significant accomplishment given that downtime has long been one of the major criticisms of the network.

Meanwhile, centralized exchanges appeared to take precautions against volatility. In the past, there was often be a mad dash for users to send their newly airdropped tokens to CEXs and sell them; with next to no liquidity, this caused large price dislocations.

This time around, most CEXs announced that they would allow deposits and only open trading once certain liquidity parameters were met. Bybit was the first to open trading at 3pm UTC, as soon as the airdrop went live; it began trading at $2 before falling to the on-chain price of around $0.75. HTX, MEXC, and OKX all waited until 3:10pm UTC, though there was still some strange price action on HTX. Binance did not open trading until 3:30pm UTC.

Coinbase buying spree causes wick to $43,700.

On Friday, a flurry of buying caused the exchange’s BTC-USD price to rise and fall more than 2% in less than a minute. Just after 3pm UTC, nearly 100 market buy orders were placed nearly simultaneously, the largest of which was worth $1.1mn USD. In total, about 600 BTC worth $25mn were purchased in less than a minute. While liquidity has improved and Coinbase’s BTC-USD pair is one of the most liquid BTC instruments available, this rapid and large buying caused its price to jump from $42,800 to $43,700 in just a few seconds. It’s unclear why the orders were placed like this, though user error is a likely answer.

Spreads narrow post-ETF approvals.

After experiencing significant volatility in early January, the bid-ask spreads for BTC-USD markets on three major U.S.-available exchanges — Coinbase, Kraken and Bitstamp — have declined in the days following the spot ET approvals. The trend suggests liquidity conditions are improving and mirrors an increase in BTC market depth.

The bid-ask spread is the difference between the highest price a buyer is willing to pay for an asset and the lowest price a seller is willing to accept. Typically, the smaller the spread the more liquid the market. Kraken had the most volatile spreads in January, spiking to 10bps on January 20. Spreads on Bitstamp and Coinbase peaked at 6.7 and 1.7, respectively, between Jan 8-13, before dropping below 1bps last week.

The trend was not limited to U.S. markets (or to BTC). The average bid-ask spread for the most liquid BTC and ETH trading pairs has fallen on most exchanges.

Coinbase and Kraken saw the strongest decline while the drop was less pronounced on Binance and OKX, which already offer very low spreads.

Overall, the approval of spot ETFs is likely to reignite the fee war between exchanges; Coinbase has already announced fee waivers for large traders. This will put further downward pressure on spreads, which are heavily dependent on exchange fee structure.

The U.S. Fed injects volatility into markets.

Risk assets saw significant volatility last week after the U.S. central bank pushed back against market expectations for imminent rate cuts and data showed that the labor market remains resilient. In the days after the Fed’s FOMC press conference, probabilities for a March rate cut dwindled from more than 54% to just 15.5%, according to the CME FedWatch tool. Overall, however, the macro backdrop remains supportive, with the Fed expected to start cutting rates in Q2. This will coincide with the Bitcoin halving event, which is seen as a potential tailwind for crypto assets.