Rho Markets, a liquidity and lending protocol built on the Ethereum Layer 2 network Scroll, announced the temporary suspension of its platform operations on Friday (19th) due to detected abnormal activities. A cybersecurity firm reported that Rho Markets had been exploited, potentially resulting in losses exceeding $7.6 million. However, this incident appears not to be a hacking event as the “attacker” has expressed willingness through on-chain messages to return the funds.
Blockchain security company Cyvers stated on social media that the platform’s suspension seemed linked to a malicious actor gaining control over oracle access. Affected liquidity pools involved stablecoins such as $USDC and $USDT. The attacker currently holds assets worth $7.6 million across multiple chains.
The Scroll team has also acknowledged potential vulnerabilities in their ecosystem, stating on the X platform that shortly after, blockchain investigator ZachXBT noted the attacker’s on-chain message. According to its contents, the actor appears not to be a hacker.
The actor behind this incident claimed that their MEV (Maximum Extractable Value) robot profited from misconfigurations in Rho Market’s oracle pricing. They stated, “We understand these funds belong to users and are willing to return them in full,” but they requested Rho Market acknowledge that this was not an exploit or hacking incident, but rather due to improper platform configuration. They also demanded clarity on how similar incidents could be prevented in the future.
Later, Yu Xi, founder of cybersecurity firm SlowMist, revealed that Rho Markets had almost entirely returned the 2203 ETH taken by a MEV robot due to oracle issues.
This incident sparked controversy within the crypto community, with some questioning Scroll’s halting of the network, claiming it contradicted core blockchain values of “permissionless” and “censorship-resistant.”
In response, Scroll co-founder Ye Zhang clarified that it was merely a delay in final confirmation to ensure protocol security, asserting that the chain was not halted and continued to operate as usual. Zhang further noted that any delay in final confirmation was within normal ranges (approximately 30 minutes). He added, “We won’t be able to do this in the next phase of decentralization, which is still ongoing.”