Cyrus Finance hack — March 2026

CyrusTreasury, the vault contract of the BNB Chain yield protocol Cyrus Finance, was exploited on or about 22 March 2026 in a single transaction. The contract managed PancakeSwap V3 liquidity positions. To decide how much liquidity to remove when a depositor exited, its withdrawUSDTFromAny path read sqrtPriceX96 straight from the pool's slot0, the live spot price in the current block, without a time-weighted average or an external price feed. The attacker took a flash loan of about 1,798 ETH, swapped it into USDT to push the pool price far out of line, then triggered the exit so the position was unwound almost entirely on the ETH side, swapped back to restore the price and repaid the loan. The vulnerable contract sat and the proceeds went. Two independent transaction-level analyses, by DarkNavy and by BlockSec, put the attacker's net gain at roughly 28.1 ETH plus about 454,000 USDT, or approximately $512,000 to $525,000. The two disagree on the calendar date: DarkNavy places the transaction on 22 March and publishes the transaction hash, while BlockSec dates the incident 23 March in its 23 to 29 March roundup. The date is recorded here as approximate for that reason. A much larger figure, around $5 million, circulates in third-party hack listings for this incident. No published analysis supports it, none of the listings show how it was derived, and it is an order of magnitude above what the transaction-level work shows, so it is not recorded here. No statement from the Cyrus Finance team has been published, no funds are known to have been returned, and the attacker has not been identified.