Rocket Shuts Down After a $287K Market Manipulation

A price manipulation attack drained $287,000 from perpetual trading platform Rocket on 5 September after an unidentified trader exploited a dormant trading pair with minimal liquidity. The platform has suspended all deposits, withdrawals, and trading while it coordinates with law enforcement and security firms to trace the stolen funds.

How a Burner Account Turned Fake Profits Into Real Withdrawals

The attacker targeted an inactive perpetual trading pair that received minimal monitoring, posting artificially inflated orders and trading against themselves through a burner account at approximately 19:00 UTC on 5 September. The self-dealing generated what the Rocket Foundation described as “fake profits” in one account while deliberately bankrupting the disposable counterpart. The profitable account then withdrew the $287,000 through Rocket’s cross-chain bridge before the platform detected the anomaly. The entire sequence, from initial order placement to fund extraction, exploited the absence of volume-based alerts on the dormant pair.Blockchain security firm SlowMist independently reviewed the incident and classified it as a price manipulation attack, confirming the $287,000 loss figure. Rocket disclosed its findings on 7 September via X and announced a platform-wide halt to all activity pending a full investigation.

Thin Markets Remain a Structural Weakness for Perp DEXs

The method mirrors the March 2025 JELLY market incident on Hyperliquid, where a trader exploited thin liquidity to push losses onto the platform’s shared vault. Hyperliquid’s HLP vault absorbed roughly $4 million from a leveraged Ether position the same month. In both cases, low-volume trading pairs provided the entry point. Hyperliquid's HLP vault absorbed its losses directly, while on Rocket the shortfall was socialized across the platform's remaining users because the bankrupt burner account could not cover the fake profit.The pattern points to a structural gap across perpetual DEXs: dormant markets with automated liquidity remain exploitable when monitoring systems fail to flag abnormal order flow relative to historical volume. Rocket’s bridge served as the extraction layer, converting manipulated positions into withdrawable funds before any circuit breaker intervened.

Smaller Accounts First, But no Recovery Timeline

Rocket stated it would prioritise refunds for smaller accounts but provided no timeline, eligibility criteria, or details on the size of any recovery fund. The platform said it is coordinating with exchanges, bridges, and stablecoin issuers to trace and freeze the stolen assets.  No recoveries have been confirmed, and Rocket has not disclosed whether the attacker’s wallet has been identified or flagged by counterparties.Deposits, withdrawals, and trading remain suspended indefinitely. The incident adds to a growing list of perpetual DEX exploits in 2026, with DeFi losses exceeding $1.3 billion in the first eight months of the year, according to CertiK and TRM Labs data reported by crypto.news.Whether Rocket can resume operations depends on the outcome of the fund-tracing effort and the platform’s ability to restructure its market monitoring before relaunching dormant pairs. Users with funds on Rocket have no access to deposits or withdrawals while the investigation continues, and the platform has offered no deadline for restoring services. The stated priority for smaller accounts suggests larger depositors face a longer wait. Anyone holding open positions on Rocket should monitor the platform’s X account for updates on the refund process and treat any funds on the platform as inaccessible until further notice.