Mithril Trading Bot Security Breach: Paradex Revokes 57 Compromised Subkeys

rekt_but_vibing · 2026-01-29T02:14:06+00:00

On January 21, Paradex announced a security breach affecting its Mithril trading bot, exposing 57 user subkeys. Although these cannot withdraw funds, they enable unauthorized trading. Paradex has since revoked the subkey registry and urges users to rigorously evaluate third-party integrations for security.

rekt_but_vibing

2026-01-29 02:14:06

Abstract generation in progress

On January 21, Paradex disclosed a significant security incident affecting its Mithril trading bot. The platform revealed that its internal system was infiltrated, leading to the exposure of approximately 57 user subkeys. Although these credentials cannot directly access user funds, they carry considerable risk as they enable trading permissions on the account.

What Happened to Mithril

The compromised subkeys were tied to Mithril, Paradex’s automated trading solution. These digital credentials are primarily designed to facilitate integration between the trading bot and third-party applications, allowing seamless portfolio management across multiple platforms. The breach exposed users who had previously authorized the Mithril bot to operate on their accounts. In response, Paradex immediately suspended all XP transfers and revoked the entire subkey registry associated with Mithril to prevent further unauthorized activity.

Understanding Subkey Risks

While subkeys lack withdrawal capabilities, their compromise poses a legitimate threat to trading accounts. Attackers could potentially execute unauthorized trades, manipulate positions, or drain account liquidity without direct access to withdrawal functions. This distinction—between withdrawal capability and trading control—is crucial for users to understand. The incident highlights the vulnerability of third-party integration points, even when not directly tied to fund transfers.

Protecting Your Account

Paradex recommends that users exercise vigilance when granting permissions to third-party services. Account holders should carefully evaluate the security risks associated with each third-party integration and consider limiting subkey permissions to essential applications only. For affected users previously connected to Mithril, a comprehensive audit of account authorization history is advisable. The breach serves as a broader reminder that robust security hygiene extends beyond password protection to encompassing all credential types that grant trading authority.

MITH-0,57%

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.