{"investigation":{"slug":"rho-markets","entity_name":"Rho Markets","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Rho Markets is a DeFi lending protocol (Compound V2 fork) deployed on Scroll, an Ethereum Layer 2 ZK-rollup network. On July 19, 2024, a misconfigured price oracle allowed an MEV bot to extract approximately $7.6 million in user funds; the operator voluntarily returned all funds after demanding a public acknowledgment of the misconfiguration. Despite full fund recovery, the protocol's TVL collapsed to near-zero and remains essentially inactive as of 2026.","sections":[{"content":"On July 19, 2024, Rho Markets suffered a critical security incident in which approximately $7.5–7.6 million in user funds were extracted from its USDC, USDT, and wstETH liquidity pools. The root cause was a deployment-time misconfiguration: the price oracle for ETH was erroneously set to the WBTC/USD price feed rather than the ETH/USD feed. Because WBTC trades at roughly 20 times the price of ETH, an MEV bot was able to deposit ETH as collateral and borrow far in excess of the ETH value, creating approximately $7.5 million in bad debt. The exploit was confirmed by on-chain security firms Cyvers and BlockSec, with Dedaub publishing a post-mortem confirming the oracle address mapping error. The protocol halted operations immediately upon detection. Rekt.news classified the incident as price oracle manipulation; however, Rho Markets and the MEV bot operator both characterized it as a misconfiguration rather than a malicious exploit.","heading":"Oracle Misconfiguration Incident (July 2024)","sources":[{"url":"https://dedaub.com/blog/rho-markets-incident/","name":"dedaub.com","type":"other","credibility":3},{"url":"https://rekt.news/rho-market-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://protos.com/mev-bot-to-return-7-5m-if-rho-markets-admits-to-oracle-error/","name":"protos.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/rho-markets-exploit-scroll/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/rho-markets-on-scroll-exploit-analysis-965991270f56","name":"olympixai.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In an unusual step, the Scroll team temporarily paused L2 chain finalization following the incident to assess whether the breach was contained to Rho Markets or indicated a broader network vulnerability. After concluding that the issue was application-specific and not a flaw in the Scroll protocol itself, chain finalization was resumed. This represented one of the first instances of an Ethereum Layer 2 network halting finality in response to a DeFi application-level incident. The intervention drew commentary regarding the tradeoffs between decentralization and emergency response capabilities on L2 networks.","heading":"Scroll Chain Halt and Network Response","sources":[{"url":"https://thedefiant.io/news/hacks/scroll-halts-chain-finalization-after-usd7m-rho-market-exploit","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/ethereum-layer-2-scroll-halts-chain-finalization-after-rho-markets-suffers-7-6m-breach/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/rho-markets-exploit-scroll/","name":"cryptobriefing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The MEV bot operator sent an on-chain message stating: 'our MEV bot have profited from your price oracle misconfiguration. We understand that the funds belong to users and are willing to fully return.' The operator conditioned the return on Rho Markets publicly admitting that the issue was a misconfiguration on their end, not a hack or exploit, and outlining steps to prevent recurrence. The SEAL 911 emergency security response team was involved in negotiations. Rho Markets complied with the demands and all 2,202.85 ETH (approximately $7.6 million at the time) was returned to a multi-sig Safe wallet. The protocol announced on July 19, 2024 that no user funds were permanently lost and outlined a three-step recovery: identifying affected accounts, replenishing token pools, and restoring lending and transfer functions. Decrypt and Unchained Crypto confirmed the full fund return.","heading":"Fund Recovery and MEV Operator Demands","sources":[{"url":"https://decrypt.co/240653/rho-markets-scroll-exploit-funds-returned","name":"decrypt.co","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/scroll-lending-protocol-rho-says-no-funds-lost-after-7-6-million-oracle-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/rho-loss","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://protos.com/mev-bot-to-return-7-5m-if-rho-markets-admits-to-oracle-error/","name":"protos.com","type":"other","credibility":3},{"url":"https://coinedition.com/rho-markets-recovers-7-6-million-in-stolen-funds-exploiter-demands-misconfiguration-tag/","name":"coinedition.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Rho Markets was positioned as the native lending protocol on the Scroll ecosystem, operating as a fork of Compound V2. The protocol supported overcollateralized lending against mainstream assets including ETH, wBTC, USDC, USDT, and liquid restaking tokens (LRTs). Rho Markets integrated Chainlink price oracles for on-chain price feeds and received backing from the Scroll team in the form of partnership facilitation and technical support. The protocol was founded around 2022 and launched on Scroll mainnet. No public funding round for Rho Markets (as distinct from the separately named Rho Protocol/Rho Labs, which is an interest rate derivatives platform) has been disclosed. As of the DeFiLlama data available in 2026, Rho Markets holds approximately $8 in TVL — down from a pre-incident peak of approximately $38–43 million — and is ranked #519 in the lending sector.","heading":"Protocol Background and Architecture","sources":[{"url":"https://rhomarkets.medium.com/rho-markets-the-native-liquidity-layer-on-scroll-638664168127","name":"rhomarkets.medium.com","type":"other","credibility":3},{"url":"https://www.chainlinkecosystem.com/ecosystem/rho-markets","name":"chainlinkecosystem.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/rho-markets","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.rootdata.com/Projects/detail/Rho%20Markets?k=MTI4ODc%3D","name":"rootdata.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security firm Dedaub confirmed that the misconfiguration was introduced at deployment time and not during a contract upgrade: 'This issue occurred due to the erroneous configuration of the ETH oracle price feed to the BTC price feed.' The error caused all ETH collateral to be priced at the WBTC value — approximately 20 times higher — enabling overborrowing and bad debt. Dedaub noted that a prior security audit had flagged oracle implementation as a risk area. The Olympix analysis additionally noted a suspicious oracle contract ownership transfer prior to the drain event, suggesting a possible private key leak or insider access. BlockSec confirmed the ownership transfer. The incident illustrates that Compound V2 forks carry deployment-time configuration risks that code audits alone may not catch, particularly when oracle address mappings are not independently verified post-deployment.","heading":"Technical Security Analysis","sources":[{"url":"https://dedaub.com/blog/rho-markets-incident/","name":"dedaub.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/rho-markets-on-scroll-exploit-analysis-965991270f56","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://rivanorth.com/blog/hack-explained-rho-market","name":"rivanorth.com","type":"other","credibility":3},{"url":"https://bsc.news/post/rho-markets-hit-by-7-5-m-hack-attackers-demand-admission-of-oracle-error-for-fund-return","name":"bsc.news","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2026, Rho Markets has effectively ceased meaningful operation. DeFiLlama records the protocol's TVL at approximately $8, with $0 in active loans. The protocol website (rhomarkets.xyz) and documentation (docs.rhomarkets.xyz) remain accessible but show no material activity. There are no known regulatory actions, lawsuits, or SEC enforcement proceedings against Rho Markets. The protocol has not announced any relaunch, v2, or successor product. Rho Markets should not be confused with Rho Protocol (rho.trading) or Rho Labs, which are separate entities focused on cryptonative interest rate derivatives trading and have raised $2.2 million in pre-seed and $4 million in seed funding from investors including Speedinvest and CoinFund.","heading":"Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/rho-markets","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.rhomarkets.xyz/","name":"rhomarkets.xyz","type":"other","credibility":3},{"url":"https://docs.rhomarkets.xyz/","name":"docs.rhomarkets.xyz","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-06-08","event":"Rho Markets founded; protocol development begins on Scroll ecosystem.","source":""},{"date":"2024-07-19","event":"Oracle misconfiguration exploit detected: MEV bot drains approximately $7.5-7.6 million in USDC, USDT, and wstETH from Rho Markets pools on Scroll within minutes.","source":""},{"date":"2024-07-19","event":"Rho Markets halts protocol operations. Scroll team temporarily pauses L2 chain finalization to assess scope of breach.","source":""},{"date":"2024-07-19","event":"MEV bot operator sends on-chain message indicating willingness to return all funds, contingent on Rho Markets publicly admitting oracle misconfiguration error.","source":""},{"date":"2024-07-19","event":"Scroll resumes chain finalization after determining exploit was confined to Rho Markets application layer.","source":""},{"date":"2024-07-19","event":"Rho Markets complies with MEV operator demands; all 2,202.85 ETH (approximately $7.6 million) returned to protocol multi-sig Safe wallet. Team announces no user funds permanently lost.","source":""},{"date":"2024-07-19","event":"Dedaub, Olympix, and other security firms publish post-mortems confirming ETH oracle was misconfigured to use the WBTC/USD price feed at deployment time.","source":""},{"date":"2026-05-27","event":"Rho Markets TVL stands at approximately $8 with $0 in active loans; protocol is effectively inactive with no announced relaunch.","source":""}],"sources_used":[{"url":"https://dedaub.com/blog/rho-markets-incident/","name":"dedaub.com","type":"other","archive_url":"http://web.archive.org/web/20260521112258/https://dedaub.com/blog/rho-markets-incident/","credibility":3,"archive_timestamp":"2026-05-21T11:22:58+00:00"},{"url":"https://rekt.news/rho-market-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260415163552/https://rekt.news/rho-market-rekt","credibility":3,"archive_timestamp":"2026-04-15T16:35:52+00:00"},{"url":"https://protos.com/mev-bot-to-return-7-5m-if-rho-markets-admits-to-oracle-error/","name":"protos.com","type":"other","archive_url":"http://web.archive.org/web/20260612053634/https://protos.com/mev-bot-to-return-7-5m-if-rho-markets-admits-to-oracle-error/","credibility":3,"archive_timestamp":"2026-06-12T05:36:34+00:00"},{"url":"https://cryptobriefing.com/rho-markets-exploit-scroll/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251016182405/https://cryptobriefing.com/rho-markets-exploit-scroll/","credibility":3,"archive_timestamp":"2025-10-16T18:24:05+00:00"},{"url":"https://olympixai.medium.com/rho-markets-on-scroll-exploit-analysis-965991270f56","name":"olympixai.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251118214420/https://olympixai.medium.com/rho-markets-on-scroll-exploit-analysis-965991270f56","credibility":3,"archive_timestamp":"2025-11-18T21:44:20+00:00"},{"url":"https://thedefiant.io/news/hacks/scroll-halts-chain-finalization-after-usd7m-rho-market-exploit","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20260413204939/https://thedefiant.io/news/hacks/scroll-halts-chain-finalization-after-usd7m-rho-market-exploit","credibility":3,"archive_timestamp":"2026-04-13T20:49:39+00:00"},{"url":"https://cryptoslate.com/ethereum-layer-2-scroll-halts-chain-finalization-after-rho-markets-suffers-7-6m-breach/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260210054744/https://cryptoslate.com/ethereum-layer-2-scroll-halts-chain-finalization-after-rho-markets-suffers-7-6m-breach/","credibility":3,"archive_timestamp":"2026-02-10T05:47:44+00:00"},{"url":"https://decrypt.co/240653/rho-markets-scroll-exploit-funds-returned","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260417210356/https://decrypt.co/240653/rho-markets-scroll-exploit-funds-returned","credibility":3,"archive_timestamp":"2026-04-17T21:03:56+00:00"},{"url":"https://unchainedcrypto.com/scroll-lending-protocol-rho-says-no-funds-lost-after-7-6-million-oracle-exploit/","name":"unchainedcrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829184833/https://unchainedcrypto.com/scroll-lending-protocol-rho-says-no-funds-lost-after-7-6-million-oracle-exploit/","credibility":3,"archive_timestamp":"2026-08-29T18:48:33+00:00"},{"url":"https://www.web3isgoinggreat.com/single/rho-loss","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260211041406/https://www.web3isgoinggreat.com/single/rho-loss","credibility":3,"archive_timestamp":"2026-02-11T04:14:06+00:00"},{"url":"https://coinedition.com/rho-markets-recovers-7-6-million-in-stolen-funds-exploiter-demands-misconfiguration-tag/","name":"coinedition.com","type":"other","archive_url":"https://web.archive.org/web/20260829182318/https://coinedition.com/rho-markets-recovers-7-6-million-in-stolen-funds-exploiter-demands-misconfiguration-tag/","credibility":3,"archive_timestamp":"2026-08-29T18:23:18+00:00"},{"url":"https://rhomarkets.medium.com/rho-markets-the-native-liquidity-layer-on-scroll-638664168127","name":"rhomarkets.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.chainlinkecosystem.com/ecosystem/rho-markets","name":"chainlinkecosystem.com","type":"other","archive_url":"http://web.archive.org/web/20260308232453/https://www.chainlinkecosystem.com/ecosystem/rho-markets","credibility":3,"archive_timestamp":"2026-03-08T23:24:53+00:00"},{"url":"https://defillama.com/protocol/rho-markets","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootdata.com/Projects/detail/Rho%20Markets?k=MTI4ODc%3D","name":"rootdata.com","type":"other","archive_url":"https://web.archive.org/web/20260829153143/https://www.rootdata.com/Projects/detail/Rho%20Markets?k=MTI4ODc%3D","credibility":3,"archive_timestamp":"2026-08-29T15:31:43+00:00"},{"url":"https://rivanorth.com/blog/hack-explained-rho-market","name":"rivanorth.com","type":"other","archive_url":"http://web.archive.org/web/20260517143726/https://rivanorth.com/blog/hack-explained-rho-market","credibility":3,"archive_timestamp":"2026-05-17T14:37:26+00:00"},{"url":"https://bsc.news/post/rho-markets-hit-by-7-5-m-hack-attackers-demand-admission-of-oracle-error-for-fund-return","name":"bsc.news","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.rhomarkets.xyz/","name":"rhomarkets.xyz","type":"other","archive_url":"http://web.archive.org/web/20260310002935/https://www.rhomarkets.xyz/","credibility":3,"archive_timestamp":"2026-03-10T00:29:35+00:00"},{"url":"https://docs.rhomarkets.xyz/","name":"docs.rhomarkets.xyz","type":"other","archive_url":"http://web.archive.org/web/20260411145412/https://docs.rhomarkets.xyz/","credibility":3,"archive_timestamp":"2026-04-11T14:54:12+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:30.813527+00:00","updated_at":"2026-08-30T01:16:26.201978+00:00"}}