DeltaPrime on Arbitrum suffered a $1M loss on July 23, 2024 when a flawed account ownership transfer allowed attackers to take control of accounts and withdraw collateral.

On July 23, an attacker exploited a misconfiguration to gain access to $1 million from 13 different Prime accounts. This misconfiguration allowed the attacker to illegitimately transfer ownership of the Prime accounts to their own address, enabling them to repay loans and withdraw collateral. On July 24, the attacker returned $900,000.