Typus Finance hack — October 2025

On 15 October 2025 at 13:05 UTC an attacker began draining the Typus Liquidity Pool, the vault backing perpetual futures trading on Typus Finance, a derivatives protocol on Sui. The post-mortem Typus published the next day lists the assets taken as 588,357.9 SUI, 1,604,034.7 USDC, 0.6 xBTC and 32.227 suiETH, worth approximately $3.44 million.

The cause was a missing authorisation check rather than market manipulation. The update_v2 function in Typus's own oracle module, part of a package deployed on 13 November 2024, did not verify the caller, so any address could write an arbitrary price into the oracle. Once the price was under the attacker's control, swaps against the pool settled at whatever value they set. Typus states that this package was outside the scope of the audit MoveBit carried out in May 2025. The team paused all Typus contracts at 13:39 UTC, 34 minutes after the first malicious transaction, notified the Sui Foundation at 13:48 UTC and filed a report with law enforcement at 14:54 UTC. Security firm Hacken, cited by Unchained, reported that the proceeds were swapped into DAI roughly two hours after the exploit and that the attacker's wallet had been funded via Tornado Cash.

The published figures differ. The itemised post-mortem total is $3.44 million; Typus's own October review, published on 5 November, describes the TLP loss as $3.26 million. Typus returned collateral for paused perpetual positions directly to traders, restarted its options and SAFU products after review, and on 23 October published a tiered recovery plan under which users with losses below $10,000 receive full cash compensation and larger holders receive partial cash plus a restored claim.