Rocket suspends operations after attacker drains $287K through dormant perpetual market manipulation

Rocket has suspended all deposits, withdrawals, and trading on its platform following a price manipulation attack on September 5, 2026. An attacker targeted an inactive perpetual market using a burner account and self-trading to generate artificial profits, withdrawing approximately $287,000 from the Rocket Bridge. Rocket is working with law enforcement and security firms to trace the funds and is preparing a recovery plan that prioritizes refunds for smaller affected accounts.

Rocket perpetual market manipulation attack

• ▪Blockchain security tracker SlowMist classified the September 5, 2026 Rocket platform incident as a price manipulation attack and recorded the loss at $287,000.
• ▪On September 5, 2026, at approximately 19:00 UTC, an attacker targeted an inactive perpetual market on the Rocket platform using a burner account, resulting in a loss of approximately $287,000.

Self-trading price manipulation mechanics

• ▪The profitable account created during the Rocket platform manipulation withdrew approximately $287,000 from the Rocket Bridge, leaving the resulting loss to be socialized across the platform.
• ▪The attacker on the Rocket platform placed orders at artificially inflated prices and traded against themselves using a disposable account, generating artificial profits in one account while pushing the burner account into insolvency.

Platform operations suspension

• ▪Following the September 5, 2026 incident, Rocket paused all deposits, withdrawals, and trading on its platform while its team, security firms, and law enforcement investigate.
• ▪Rocket has not provided a timeline for restoring its affected services or disclosed how many users were exposed to the socialized loss resulting from the September 5, 2026 incident.

Fund recovery coordination efforts

• ▪Rocket is working with unnamed security firms and law enforcement agencies to investigate the September 5, 2026 attack and recover the funds.
• ▪Rocket is coordinating with cryptocurrency exchanges, cross-chain bridges, and stablecoin issuers to trace and freeze the stolen $287,000.

User compensation plan prioritization

• ▪Rocket is preparing a recovery plan for users affected by the September 5, 2026 incident, with smaller accounts expected to receive priority when refunds begin.
• ▪Rocket warned users to watch for impersonators and stated that recovery information will be published only through its official X account and Discord channels.

Related DeFi market manipulation incidents

• ▪In March 2025, a trader targeted Hyperliquid's thin JELLY market by opening a large short position while buying the token on decentralized exchanges, pushing the short toward liquidation and transferring the position to Hyperliquid's liquidity vault.
• ▪GMX completed a roughly $44 million compensation plan in August 2025 for liquidity providers affected by an exploit of its V1 GLP pool, using GLV tokens for distributions and covering a $2 million shortfall from its DAO treasury.
• ▪In March 2025, Hyperliquid's HLP vault absorbed around $4 million in losses after a trader withdrew collateral from a highly leveraged Ether position before liquidation.

Debatable claims

• ▪Rocket should prioritize smaller accounts in its recovery plan
• ▪Rocket should not socialize the losses from the perpetual market manipulation across its users

1 source