Rocket Perpetual DEX Self-Trading PnL Extraction — $287K

On September 5, 2026, an attacker found an illiquid, untraded market on Rocket — a purpose-built proprietary layer-1 blockchain for perpetual derivatives trading launched earlier in the year — and used two accounts under their control to trade against themselves, generating artificial profit in one account while dumping matching losses into a disposable second account they then abandoned. In roughly 40 minutes the attacker withdrew about $329,600, of which $42,200 was their own recycled stake, for a net theft of approximately $287,400 that effectively emptied Rocket's bridge contract. The stolen funds were moved to other blockchains within about 20 minutes. Rocket froze the platform, engaged law enforcement, and promised a refund plan prioritizing smaller customers. The disclosure is Rocket's own preliminary account; it names neither the attacker nor any transaction hashes.