{"investigation":{"slug":"moby","entity_name":"Moby Trade","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Moby Trade (moby.trade) is an on-chain options protocol built on Arbitrum and Berachain, launched in 2024 and backed by an Arbitrum Foundation grant. On January 8, 2025, the protocol suffered a critical security breach when a private key controlling proxy admin contracts was compromised, resulting in approximately $2.5 million in user funds being drained; roughly $1.5 million was subsequently recovered through an intervention by the SEAL911 security team. The protocol resumed operations after the incident and expanded to Berachain mainnet in February 2025, but the unrecovered ~$1 million in ETH and WBTC was routed through privacy mixers including Railgun and Tornado Cash, leaving those funds effectively unrecoverable.","sections":[{"content":"On January 8, 2025, Moby Trade suffered a security breach when an attacker obtained the admin-privileged private key used to authorize upgrades to the protocol's core proxy contracts on Arbitrum. The attacker first tested the exploit on Arbitrum Sepolia testnet at approximately 11:56 UTC, then executed a malicious contract upgrade on mainnet at 12:53 UTC, transferring admin privileges to an attacker-controlled address. Between 15:24 and 16:48 UTC, the attacker invoked the emergencyWithdrawERC20 function against the protocol's S_VAULT and M_VAULT contracts, extracting 207.78 wETH (approximately $627,678), 3.774 wBTC (approximately $345,222), and 30,180 USDC from the vaults, totalling approximately $2.47 million. The Moby team coordinated with the SEAL911 security team, which identified that the attacker's own malicious contract contained an unprotected upgrade function. MEV researcher Tony Ke (Solayer Labs/Fuzzland) exploited this oversight to recover 1,470,191 USDC before the attacker could move it, finishing approximately 30 seconds behind the original attacker in doing so. The net unrecovered loss was approximately $1 million in ETH and WBTC. The root cause was identified by the team as excessive privileges concentrated in a single private key used for contract upgrades, constituting a critical access-control design failure. No evidence of insider involvement has been publicly reported by any investigator.","heading":"Security Incident — January 2025 Private Key Compromise","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-moby-trade-hack-january-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/mobytrade-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://medium.com/moby-trade/moby-post-mortem-report-growth-plan-504ad5b0dd35","name":"medium.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/moby","name":"revoke.cash","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","name":"merklescience.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the unrecovered ETH and WBTC were dispersed across more than 35 wallet addresses in an apparent effort to obfuscate the trail. Merkle Science's on-chain analysis identified several laundering techniques: assets were swapped and bridged between networks; 9.5634 ETH was sent to Railgun, a zero-knowledge privacy protocol; and a prior connection was identified between the attacker's funding address and a Tornado Cash withdrawal of 0.9706 ETH dating to September 27, 2024, suggesting the attacker had used mixing infrastructure before the attack was carried out. Recovered USDC was deposited to OKX exchange. The use of Railgun and Tornado Cash significantly diminishes the probability of recovering the remaining ~$1 million. Moby's post-mortem did not publicly disclose whether law enforcement has identified suspects.","heading":"Fund Laundering and On-Chain Tracing","sources":[{"url":"https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","name":"merklescience.com","type":"other","credibility":3},{"url":"https://rekt.news/mobytrade-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the incident, Moby Trade published a detailed post-mortem on Medium and established war rooms with security partners including SEAL911 and SlowMist. The team coordinated with Circle (issuer of USDC), Stargate, and Rhino.fi in an attempt to freeze additional assets. Users were immediately notified to revoke all contract approvals. The compensation plan announced by the team covered two categories of affected users: options holders were to have expired options treated as closed at the most favorable price, with compensation delivered by January 13, 2025, and active positions replaced with equivalent new options; liquidity pool users were to receive full compensation from the protocol treasury and recovered funds, with withdrawal access reopened in phases. Protocol operations resumed on a target date of January 15, 2025 with new security measures in place. Security improvements announced included separation of deployment and admin keys, multi-layered key management, enhanced organizational network security, and multi-step verification for contract deployments.","heading":"Team Response and Compensation","sources":[{"url":"https://medium.com/moby-trade/moby-post-mortem-report-growth-plan-504ad5b0dd35","name":"medium.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/moby","name":"revoke.cash","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-moby-trade-hack-january-2025","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Moby Trade is an on-chain options protocol powered by a Synchronized Liquidity Engine (SLE) and a Dynamic Risk Premium model, designed to provide real-time pricing, tight spreads, and deep liquidity on Arbitrum. The protocol received an Arbitrum Foundation grant in January 2024, becoming the first options protocol to receive such a grant prior to mainnet launch. A mainnet launch followed in April 2024. Since its alpha launch on Arbitrum, Moby accumulated over $3.5 billion in total options trading volume by early 2025, making it the leading on-chain options protocol on Arbitrum by volume. In February 2025, Moby expanded to the Berachain mainnet, integrating with Berachain's Proof of Liquidity consensus mechanism through a Structured Product Vault, and was selected for Berachain's Request for Application program. Partners include Kodiak, Infrared, PumpBTC, and GMX. The protocol also engaged GSR to enhance liquidity and OTC trading for its native MOBY token.","heading":"Protocol Background and History","sources":[{"url":"https://www.prnewswire.com/news-releases/moby-the-next-on-chain-options-protocol-receives-grant-from-arbitrum-foundation-302042108.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://www.prnewswire.com/news-releases/moby-the-next-on-chain-options-protocol-mainnet-launch-302120855.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://chainwire.org/2025/02/17/moby-a-leading-options-protocol-expands-to-berachain-mainnet/","name":"chainwire.org","type":"other","credibility":3},{"url":"https://medium.com/moby-trade/moby-an-on-chain-options-protocol-receives-grant-funding-from-arbitrum-foundation-350f350ff314","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or any other government body against Moby Trade have been identified as of the research date. The protocol operates as a decentralized on-chain options platform and does not appear to be registered with any financial regulatory authority. No OFAC designations have been found for the protocol or its known associated addresses. The attacker's use of Tornado Cash and Railgun may attract regulatory scrutiny in the context of AML compliance, though no formal investigation has been publicly disclosed.","heading":"Regulatory and Compliance Status","sources":[{"url":"https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","name":"merklescience.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Moby Trade's primary risk factor for users is the January 2025 security incident, which demonstrated a centralized key management vulnerability in what presented as a decentralized protocol. The concentration of upgrade authority in a single private key represented a critical design flaw enabling complete fund drainage. Although the team implemented corrective measures and honored a compensation commitment, approximately $1 million remains unrecovered and has been routed through privacy-layer infrastructure, making recovery unlikely. The attacker's use of Tornado Cash infrastructure pre-dating the attack by several months may indicate premeditation. The protocol has since resumed operations and expanded to Berachain, suggesting continued development activity, but the prior security failure warrants caution. Users interacting with the protocol should verify that all prior token approvals have been revoked using tools such as revoke.cash. No evidence of fraud, rug pull, or misappropriation of funds by the team has been established by any investigator.","heading":"Risk Assessment","sources":[{"url":"https://revoke.cash/exploits/moby","name":"revoke.cash","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","name":"merklescience.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-moby-trade-hack-january-2025","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-01-23","event":"Moby receives Arbitrum Foundation grant, becoming the first on-chain options protocol to receive such a grant prior to mainnet launch.","source":""},{"date":"2024-04-08","event":"Moby Trade launches on Arbitrum mainnet.","source":""},{"date":"2024-09-27","event":"Attacker's funding address withdraws 0.9706 ETH from Tornado Cash, later identified as pre-attack infrastructure preparation.","source":""},{"date":"2025-01-08","event":"Private key compromise: attacker tests exploit on Arbitrum Sepolia at 11:56 UTC, executes malicious contract upgrade on mainnet at 12:53 UTC, and drains S_VAULT and M_VAULT between 15:24 and 16:48 UTC, stealing approximately $2.47 million in wETH, wBTC, and USDC.","source":""},{"date":"2025-01-08","event":"SEAL911 and MEV researcher Tony Ke recover approximately $1.47 million USDC by exploiting an unprotected upgrade function in the attacker's own malicious contract, finishing 30 seconds behind the attacker.","source":""},{"date":"2025-01-08","event":"Remaining stolen ETH and WBTC begin dispersal across 35+ wallet addresses; 9.5634 ETH routed through Railgun privacy protocol.","source":""},{"date":"2025-01-10","event":"Moby Trade publishes incident report; users urged to revoke token approvals. Protocol operations suspended.","source":""},{"date":"2025-01-13","event":"Target date for initial compensation payments to affected options holders.","source":""},{"date":"2025-01-15","event":"Protocol operations resume with enhanced security measures including key separation and multi-step verification.","source":""},{"date":"2025-02-17","event":"Moby Trade expands to Berachain mainnet, integrating with Berachain's Proof of Liquidity mechanism. Moby is selected for Berachain's Request for Application program.","source":""}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-moby-trade-hack-january-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260812011243/https://www.halborn.com/blog/post/explained-the-moby-trade-hack-january-2025","credibility":3,"archive_timestamp":"2026-08-12T01:12:43+00:00"},{"url":"https://rekt.news/mobytrade-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260518010407/https://rekt.news/mobytrade-rekt","credibility":3,"archive_timestamp":"2026-05-18T01:04:07+00:00"},{"url":"https://medium.com/moby-trade/moby-post-mortem-report-growth-plan-504ad5b0dd35","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://revoke.cash/exploits/moby","name":"revoke.cash","type":"other","archive_url":"http://web.archive.org/web/20260517020042/https://revoke.cash/exploits/moby","credibility":3,"archive_timestamp":"2026-05-17T02:00:42+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","name":"merklescience.com","type":"other","archive_url":"http://web.archive.org/web/20260511062355/https://www.merklescience.com/blog/hack-track-moby-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-05-11T06:23:55+00:00"},{"url":"https://www.prnewswire.com/news-releases/moby-the-next-on-chain-options-protocol-receives-grant-from-arbitrum-foundation-302042108.html","name":"prnewswire.com","type":"other","archive_url":"http://web.archive.org/web/20251216034922/https://www.prnewswire.com/news-releases/moby-the-next-on-chain-options-protocol-receives-grant-from-arbitrum-foundation-302042108.html","credibility":3,"archive_timestamp":"2025-12-16T03:49:22+00:00"},{"url":"https://www.prnewswire.com/news-releases/moby-the-next-on-chain-options-protocol-mainnet-launch-302120855.html","name":"prnewswire.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://chainwire.org/2025/02/17/moby-a-leading-options-protocol-expands-to-berachain-mainnet/","name":"chainwire.org","type":"other","archive_url":"http://web.archive.org/web/20260514094527/https://chainwire.org/2025/02/17/moby-a-leading-options-protocol-expands-to-berachain-mainnet/","credibility":3,"archive_timestamp":"2026-05-14T09:45:27+00:00"},{"url":"https://medium.com/moby-trade/moby-an-on-chain-options-protocol-receives-grant-funding-from-arbitrum-foundation-350f350ff314","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:26.464649+00:00","updated_at":"2026-08-30T03:55:00.488856+00:00"}}