On March 22, 2026, Cyrus Finance on BSC was exploited through price manipulation. Attacker abused reliance on live PancakeSwap V3 spot price in withdrawal logic, with no TWAP or oracle resistance, to extract liquidity and tokens.

The DeFi yield protocol Cyrus Finance (CyrusTreasury contract) on BNB Chain was exploited. The attacker used a flash loan to manipulate the PancakeSwap V3 ETH/USDT pool spot price, triggering a vulnerability in the withdrawUSDTFromAny function to over-extract liquidity from an LP position, profiting approximately $516,840 before laundering the funds via Tornado Cash in 9 batches.