Preview surface — demo data. Where real data exists today (e.g. RealT, BlackRock BUIDL, Lift Dollar) we render it; everywhere else we render synthetic enrichment generated deterministically from public signal and clearly marked Demo or Inferred. The Phase 3 roadmap replaces every synthetic source with live ingestion — see Methodology → Exposure Graph & Similarity Engine.
← back to incident ledger

oracle manipulationDemo

May 17, 2025 · $8M · protocol

Narrative

On 2025-05-17, Three Sigma suffered a oracle manipulation incident resulting in approximately $7,986,539 in losses. The exploit targeted the protocol layer. Attribution: unattributed_criminal. This is a demonstration entry — not a real incident.

Classification

Root cause
oracle_manipulation
Secondary causes
price_impact_amm
Attack layer
protocol
Strategy
market_manipulation
Actor role
target
Attribution
unattributed_criminal
Attacker address
Flash loan
no
Audited at time
no
Bounty at time
no

AADAPT mappings

DEMO:AADAPT.TA0040DEMO:AADAPT.TA0007DEMO:AADAPT.T1499.001DEMO:AADAPT.T1565.003

Evidence

Disclosure date
May 18, 2025
Funds recovered
Audit firms at time
Post-mortem URLs (synthetic)
  • https://medium.com/three-sigma/post-mortem-three-sigma-2025-05-17
tx hashes (2)
  • 0x8b7304e198b4de5daaeb6b63bba7c4cecb1af9836e69df179203a3a93f0b897b
  • 0xc10e3e889666642a32825ee5aab06d1051864ff7986ad99d35c214faffca36b6