{"id":"cyrus-finance-bsc-price-manipulation-mar-2026","category":"breach","status":"closed","title":"Cyrus Finance (BNB Chain) loses about US$0.5 million in price-manipulation theft; no recovery reported","tldr":"Cyrus Finance, a yield protocol on BNB Chain, lost about US$512,000 to US$517,000 (not US$5 million) on 22 March 2026 when an attacker manipulated a PancakeSwap price. Funds went to Tornado Cash and no recovery is reported. If you used Cyrus, check with the team.","summary":"On 22 March 2026 an attacker drained money from Cyrus Finance, a yield-farming service on BNB Chain that manages PancakeSwap V3 liquidity positions. Using a flash loan, the attacker pushed the price in a trading pool, then called Cyrus's treasury withdrawal function, which worked out how much to pay using that live price. CertiK says the function also paid out both tokens of the position while counting only one, and calls the price dependence a secondary issue. The attacker took about 28 ETH and 454,000 USDT. CertiK puts the loss at about US$517,000, BlockSec at about US$512,000 and DarkNavy at about US$524,500. A tracker site lists the incident as saying one of three Cyrus pools was hit. The US$5 million figure in the first report is not supported by any page read, and one tracker says it replaced an earlier higher imported figure. CertiK says the proceeds were sent to Tornado Cash. None of the pages read report any recovery, a fix, a post-mortem or compensation from Cyrus. Whether attackers or anyone else are still exposed is not known.","action":"If you have money in Cyrus Finance, check the project's own channels for its notice and any withdrawal or compensation steps. There is no update to install, and nothing to do if you have never used it.","product":"Cyrus Finance yield protocol (BNB Chain, PancakeSwap V3 liquidity)","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["crypto","defi","bnb-chain","bsc","price-manipulation","flash-loan","pancakeswap","cyrus-finance"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Cyrus Finance Incident Analysis","url":"https://certik.medium.com/cyrus-finance-incident-analysis-91f1754a058f","by":"CertiK","date":"2026-03-23"},{"kind":"research","title":"Weekly Web3 Security Incident Roundup (Mar 23 – Mar 29, 2026)","url":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-23-mar-29-2026","by":"BlockSec","date":"2026-03-29"},{"kind":"research","title":"Cyrus Price Manipulation","url":"https://www.darknavy.org/web3/exploits/cyrus-price-manipulation/","by":"DarkNavy","date":"2026-03-22"},{"kind":"news","title":"Cyrus Finance Hack (2026)","url":"https://smartcontractshacking.com/hacks/cyrus-finance-hack-2026","by":"Smart Contract Hacking","date":"2026-03-22"}],"started":"2026-03-22","closed":"2026-03-29","created":"2026-11-03T22:04:10.151Z","updated":"2026-11-03T22:04:10.151Z","cve_notes":[],"timeline":[{"at":"2026-03-29","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"BlockSec's weekly roundup lists the incident at about US$512,000 and attributes it to a liquidity-removal formula that read the pool's live spot price. It mentions no recovery and no statement from the Cyrus Finance team.","url":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-23-mar-29-2026","by":"BlockSec","patch":null},{"at":"2026-03-23","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"CertiK published its analysis. It says the withdrawal function removed both tokens of a liquidity position but counted only USDT, and that the spot-price dependence was a secondary issue. It reports the stolen funds were sent on to Tornado Cash and that nothing was recovered.","url":"https://certik.medium.com/cyrus-finance-incident-analysis-91f1754a058f","by":"CertiK","patch":null},{"at":"2026-03-22","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"An attacker used a flash loan to push the price of a PancakeSwap V3 pool on BNB Chain and then withdrew from Cyrus Finance's treasury, taking about 28 ETH and 454,000 USDT. CertiK puts the loss at about US$517,000. The attacker's wallet had first been funded through Tornado Cash in January.","url":"https://certik.medium.com/cyrus-finance-incident-analysis-91f1754a058f","by":"CertiK","patch":"na"}],"url":"https://hard.fyi/live/cyrus-finance-bsc-price-manipulation-mar-2026/","json":"https://hard.fyi/api/live?id=cyrus-finance-bsc-price-manipulation-mar-2026"}