In January 2025, Moby Trade on Arbitrum suffered a $2.5M hack when an attacker compromised a private key controlling the proxy upgrade mechanism. The attacker performed a malicious upgrade and called emergencyWithdrawERC20() to steal stablecoins and wrapped assets, but a whitehat recovered $1.5M.

According to Moby Post-Mortem Report, on January 8, an attacker took control of the Private Key used to authorize upgrades to Moby’s core contracts, compromising the protocol. This led to the exposure of 3.77 wBTC, 207.76 wETH, and 1,500,351.5 USDC in the sOLP and mOLP liquidity pools. Of the stolen funds, 1,470,091.74 USDC was recovered with the assistance of Seal911 team.