Mango Markets, a decentralized finance (DeFi) trading platform on the Solana blockchain, has become the latest victim to hackers who stole $117 million from the platform. According to a tweet from Mango Market, the hack was caused by a price manipulation on the native MNGO token. 

On Oct 11th, the hacker manipulated the price of native token Mango (MNGO) collateral, draining the platform of massive loans. A $116 million loan was then taken out by the hacker, leaving Mango's treasury with a negative balance of 116.7 million.

Mango Markets has offered the attacker to contact them at blockworks@protonmail.com to collect a bug bounty in exchange for returning the funds. The price of the native token, Mango, is down over 40% at the time of writing.()

In this bounty, we were asked to do analysis on the Solana defi ecosystem since the Mango Markets Hack.

Has activity increased? Decreased? Are users flocking to any particular defi apps? Are they leaving the ecosystem? Chart flows in and out of centralized exchanges from the Solana ecosystem. Has staking behavior changed on Solana since the hack?

\n

For this purpose, I checked count of transactions on the Defi, count of users, count and volume of swappers and some data about staking actions.

Although total number of users who did tranansaction on the Defi, increased in 4 days after the hack, but number of transactions in 4 days before the hack was more.

The most decrease in the count of transactions was on Solend, that in total 1454 transactions was submitted in 4 days before the hack, while this number was 550 in the same period of time after the hack. But, the number of users increased sharply in 2 days after the hack. BUT I have to mention this that, in the next day after the hack, number of transactions increased more than 10 times in comparison with the day of the hack. This was the most increase in the number of transactions.

On Serum, count of transactions decreased sharply after the hack, while number of users decreased in the next day after the hack and then it increased again.

On, Zetus, number of transactions decreased sharply in the next days after the hack but in the next day, it increased and then decreased again, while number of users was stable during this period.

On Jupiter, count of transactions and users, decreased after the hack.

In the above charts, you can see some analysis about the count of swap actions to and from CEXs.

As you can see above, total count of transactions TO CEXs after the Hack was more than total count of transactions before the hack. FTX and Coinbase had the most increase.

Total count of trxs to CEXs, before and after the hack, was more than total count of trxs FROM CEXs.

Total count of transactions from CEXs in befre and after the hack was close to each other in most of the CEXs, except on Coinbase that after the hack this parameter increased.

In the above charts, you can see some analysis about the volume of swap actions to and from CEXs.

The volume in both sides, are more after the hack. Especially the volume of transactions to CEXs after the hack which was more than 2 times than the volume of before the hack. FTX, Kraken and Coinbase had the most increase in the volume after the hack for TO and FROM CEX trxs.

The most increase in the volume in both sides in on Oct 13th.

In below, you can see the analysis about stake actions:

In the above charts, you can see some analysis about the swap actions and transactions to and from CEXs and DEXs.

DEX:

You can see that the most count of swaps and swapers was submitted in the date of the hack.

The most increase in the number of swaps and swappers was on Raydium and Juppiter respectively. Number f swaps and swappers increased more than 2.5 times in the day of the hack.

CEX:

The most increase in count of users(compare 4 days before the hack to 4 days after the hack) that swaped to or from CEXs, belongs to FTX, while count of users that swapped to or from CEXs decreased in other CEXs after the hack.

Total count of swappers that swapped to and from CEXs in 4 days before the hack, was more than total count of swappers that swapped to or from CEXs after the hack,

Number of stake actions was very low in these 8 days.

Total count of stakers before the hack was more than after the hack.

The most count of stakers was on Oct 13th.

There was no stake on Zeta before the hack, while after the hack some stakers, staked on it.

Conclusion:

• Volume of transactions to and from CEXs, increased sharply after the hack.
• Number of users and transactions that sent asset to or from CEXs did not change much in before and after the hack.
• The most count of swaps and swapper on DEXs, was in the day of the hack on Raydium and Jupiter.
• Staking actions increased after the hack.