Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Cyrus Finance Flash Loan Attack: $516.84K Reported Loss

·Historical incident record

Incident Overview

The DeFi yield protocol Cyrus Finance (CyrusTreasury contract) on BNB Chain was exploited. The attacker used a flash loan to manipulate the PancakeSwap V3 ETH/USDT pool spot price, triggering a vulnerability in the withdrawUSDTFromAny function to over-extract liquidity from an LP position, profiting approximately $516,840 before laundering the funds via Tornado Cash in 9 batches.

Sources & References

Original incident referencehttps://certik.medium.com/cyrus-finance-incident-analysis-91f1754a058f (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodFirst Deposit Inflation Attack
    Reported loss$ 257,000
  2. Incident date
    Attack methodSocial Engineering
    Reported loss$ 285,000,000
  3. Incident date
    Target

    Molt EVM

    Attack methodSmart Contract Vulnerability
    Reported loss$ 127,000
  4. Incident date
    Attack methodCredential Compromise
    Reported loss$ 3,665,000
  5. Incident date
    Target

    Resolv

    Attack methodPrivate Key Leakage
    Reported loss$ 25,000,000