Incident Overview
On February 26, 2026, Ploutos Money, a low-profile DeFi lending platform, suffered a 187.36 ETH (~$388K) loss when its USDC price oracle was misconfigured to reference BTC/USD instead of the proper Chainlink feed, allowing an attacker to deposit 8-9 USDC and borrow nearly 188 ETH. The misconfiguration transaction occurred one block before the exploit, and the protocol's website and social media were immediately deleted post-exploit, leading security researchers to suspect a pre-planned exit scam rather than an external hack.
The protocol's USDC price oracle was deliberately or negligently misconfigured to pull pricing data from a BTC/USD feed instead of the appropriate USDC/USD Chainlink oracle. This resulted in USDC being valued at Bitcoin's price rather than its intended $1 peg. The attacker exploited this immediately by depositing minimal collateral of just 8-9 USDC, which the system incorrectly valued at tens of thousands of dollars, and borrowed 187.36 ETH from the lending pool.
The timing raises significant red flags: the oracle misconfiguration transaction was executed exactly one block before the exploit transaction, suggesting the attacker was either monitoring the mempool in real-time or had insider knowledge. Within minutes of the drain, Ploutos Money's website was scrubbed from the internet and its X (Twitter) account was deleted, with no warning, explanation, or post-mortem provided to users. This pattern of behavior combined with the platform's low profile, attractive yields on assets like HYPE, and the surgical precision of the attack strongly suggests this was a coordinated exit scam rather than an accidental misconfiguration or external exploit.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Ploutos Money, these are the critical security checks that could have prevented this incident (February 2026).
- Verify all logic paths related to Rugpull / Oracle Misconfiguration Exploit / Misconfigured Oracle Exploit are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Ploutos Money
The Ploutos Money hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.