dYdX V3

2022-09-23

dYdX staff member's npm account hijacked; malicious versions of 'solo' and 'perpetual' packages published with credential-stealing code affecting at least 44 crypto projects.

2023-10-29

First phase of the market manipulation attack begins on dYdX V3; attacker uses 132+ linked wallet addresses to build leveraged SUSHI long positions while purchasing SUSHI spot to inflate the price approximately 180%.

2023-11-09

Second phase of the attack targets YFI on dYdX V3; YFI open interest spikes from $0.8 million to $67 million; YFI price rises approximately 215% from ~$6,500 to over $14,000 by November 17.

2023-11-18

YFI price crashes approximately 30% within one hour; forced liquidations trigger a $9 million draw on the dYdX V3 insurance fund (~40% of total V3 insurance reserves); attacker withdraws approximately $27 million total.

2023-11-19

dYdX founder Antonio Juliano publicly attributes the $9M insurance loss to a targeted attack; FBI involvement confirmed; margin requirements raised to 100% for affected markets.

2024-05-13

Antonio Juliano steps down as CEO of dYdX Trading Inc.; Ivo Crnkovic-Rubsamen appointed CEO.

2024-07-23

dYdX V3 web frontend compromised via DNS hijacking through Squarespace registrar; counterfeit site deploys PERMIT2 wallet drainer; smart contracts unaffected; dYdX resolves DNS redirect same day.

2024-10-10

Antonio Juliano returns as CEO of dYdX Trading Inc.

2024-10-28

dYdX V3 trading, oracle price updates, and funding payments cease at 12:05 PM UTC; V3 officially sunset; Ethereum smart contract set to frozen on October 30.

2024-10-29

dYdX CEO Juliano announces 35% workforce reduction, citing competitive pressures and declining TVL from $500M to $287M; company promises strategic pivot.

2026-01-27

Socket researchers discover malicious versions of dYdX V4 npm and PyPI packages containing wallet stealers and a RAT; dYdX acknowledges the supply chain compromise and urges developers to isolate affected machines.