What happened
On 22 March 2026, Cyrus Finance reported that an attacker used a flash loan to manipulate the ETH/USDT price used by one of its BNB Chain pools. The protocol's initial notice estimated the loss at roughly $500,000; BlockSec's later analysis estimated about $512,000. This replaces a materially higher imported loss figure.
A liquidity-removal calculation trusted the current PancakeSwap V3 spot price. Because that price was flash-loan manipulable, it could be used to make a withdrawal appear valid at an economically false valuation. Critical pricing paths need manipulation-resistant observations such as a suitably designed TWAP plus bounds and circuit breakers.
How it happened
- The attacker flash-borrowed ETH and pushed the price in the PancakeSwap V3 ETH/USDT pool used by the affected Cyrus Treasury logic.
- BlockSec reported that the withdrawal calculation depended on the pool's current spot price through sqrtPriceX96.
- With the spot price temporarily distorted, the attacker withdrew an outsized amount of pool value, then restored the market state and repaid the flash loan within the same transaction.
- Cyrus stated that one of three pools was affected and that the other pools were not impacted.
- The core lesson is that a spot AMM quote is unsafe as a direct input to a withdrawal or redemption calculation when an attacker can move it atomically.
Protocol details
Market Context at Time of Hack
Evidence
- report @peckshield incident report x.com
- transaction BNB Chain exploit transaction bscscan.com
- analysis DeFiLlama defillama.com
- analysis Cyrus Finance incident notice t.me
- analysis BlockSec weekly incident roundup, 23–29 March 2026 blocksec.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
