{"investigation":{"slug":"cyrus-finance","entity_name":"Cyrus Finance","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.62,"status":"published","content_type":"investigation","summary":"Cyrus Finance is a decentralized yield-optimizer protocol operating on the BNB Smart Chain that markets itself as a high-yield DeFi platform utilizing PancakeSwap liquidity pairs and single-sided vaults. On March 22, 2026, the protocol suffered a $5 million flash loan exploit attributed to flawed pool-share accounting in its smart contracts, with no reported fund recovery. Multiple secondary domains (cyrusfinance.xyz) associated with the Cyrus Finance brand have been independently flagged as potentially malicious fake-broker sites that simulate trading activity and block user withdrawals.","sections":[{"content":"Cyrus Finance describes itself as 'a decentralized protocol designed to help users maximize returns through a transparent and secure ecosystem of smart contracts.' The platform operates as a yield optimizer on BNB Smart Chain, routing user deposits into PancakeSwap liquidity pairs through automated smart-contract vaults. The protocol offers single-sided vault deposits, meaning users deposit one token and the protocol internally manages LP pair allocation. Promotional material published by MEXC News claimed a market size exceeding $7 million and total liquidity of over $2 million at time of launch. The team has not been publicly identified; no founder names appear in the protocol's official documentation or Gitbook. The project claimed to have obtained an independent security audit from CertiK as part of a 'triple-layer security' framework that also included a protection pool and a bug bounty program.","heading":"Protocol Overview","sources":[{"url":"https://www.mexc.co/news/966376","name":"mexc.co","type":"other","credibility":3},{"url":"https://cyrus-4.gitbook.io/cyrus-docs","name":"cyrus-4.gitbook.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 22, 2026, Cyrus Finance suffered a flash loan pool-shares exploit on BNB Smart Chain resulting in approximately $5 million in losses. According to post-mortem analysis documented by security researchers and attributed to PeckShield, attackers leveraged flash loans to manipulate pool share calculations within a single atomic transaction. The root cause was identified as flawed protocol logic that failed to properly guard against flash-loan-based manipulation of pool share accounting. No fund recovery has been reported. The incident was classified as medium severity by the Smart Contract Hacking database and ranks among the top 411 all-time crypto hacks by loss amount. Bankless Times included Cyrus Finance among the most notable March 2026 DeFi hacks alongside Hyperbridge, Venus Core Pool, SolvBTC, and Silo, in a month when PeckShield reported a 96% increase in total hack losses reaching $52 million across 20 separate incidents. The hack likely could have been prevented through proper flash-loan vulnerability testing and access control verification during audit, according to security researchers.","heading":"March 2026 Flash Loan Exploit ($5 Million)","sources":[{"url":"https://smartcontractshacking.com/hacks/cyrus-finance-hack-2026","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://www.banklesstimes.com/articles/2026/04/20/crypto-hacks-hit-1-7-billion-putting-the-defi-industry-at-risk/","name":"banklesstimes.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/04/01/crypto-hacks-stole-52m-in-march-amid-shadow-contagion-threat-peckshield/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple domains operating under the Cyrus Finance brand — including cyrusfinance.xyz, cyrusfinance.net, and cyrus.finance — exhibit characteristics associated with fraudulent investment schemes. The domain cyrusfinance.xyz was registered on January 29, 2026 and received a security score of 0/100 from URL security scanner URLert, which classified it as 'potentially malicious' with no association to any known legitimate service. A Russian-language investment review site (fxidea.com) characterizes cyrusfinance.xyz as a fraudulent fake broker, alleging that 'real stock market trades do not occur' and that all account figures are simulated. Alleged victim testimonials cited in that review describe account closures upon requesting withdrawals, escalating deposit demands, losses attributed to fabricated 'technical failures,' and blocked withdrawals requiring additional 'verification fees.' Patterns described include promises of 3-5% monthly returns without risk and aggressive daily contact from account managers pressuring larger deposits. A Russian-language investment forum (MMGP) thread posted in its 'Problematic Programs' section raised concerns about opaque smart contract balances, though that thread predated the documented collapse and included some reports of small payouts. These alleged fake-broker operations appear distinct from or layered on top of the on-chain DEX protocol, and it is not fully established from available public sources whether both sets of activities are operated by the same team.","heading":"Alleged Fake-Broker Domains and Withdrawal Fraud","sources":[{"url":"https://www.urlert.com/domains/cyrusfinance.xyz","name":"urlert.com","type":"other","credibility":3},{"url":"https://fxidea.com/cyrus-finance-otzyvy.html","name":"fxidea.com","type":"other","credibility":3},{"url":"https://mmgp.com/threads/syrusfinance-cyrusfinance-xyz-cyrusfinance-app-cyrus-finance.760559/","name":"mmgp.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No founders, developers, or core team members have been publicly identified for Cyrus Finance. The protocol's official documentation (Gitbook) contains no information about team composition or identities. The absence of any publicly known team members limits accountability in the event of further losses or malfeasance. The anonymous team structure is consistent with patterns observed in higher-risk DeFi projects. ZachXBT, a pseudonymous blockchain investigator known for exposing crypto fraud, has been noted in connection with flagging this entity, though no specific public investigation post from ZachXBT specifically naming Cyrus Finance was located in available indexed sources at time of research.","heading":"Anonymous Team and Accountability Concerns","sources":[{"url":"https://cyrus-4.gitbook.io/cyrus-docs","name":"cyrus-4.gitbook.io","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"The ICIJ Offshore Leaks database — which catalogs entities from the Panama Papers and other leak investigations — contains a record for an entity named 'CYRUS FINANCE LIMITED' registered in the British Virgin Islands and linked to the jurisdiction of Jersey. The entity was incorporated on September 5, 1997, struck off on April 30, 2000, and listed as 'Defaulted.' It was managed by Mossack Fonseca, the law firm at the center of the Panama Papers scandal. The intermediary is listed as Obelisk International Trust Company (Guernsey) Limited, which has a suspended status. It cannot be confirmed from available public sources whether this offshore entity is directly connected to the current DeFi protocol operating under the Cyrus Finance name; the dates (1997-2000) predate the modern DeFi ecosystem. This information is disclosed for completeness but should be treated as low-confidence linkage without additional corroborating evidence.","heading":"Offshore Corporate Entity","sources":[{"url":"https://offshoreleaks.icij.org/nodes/10076447","name":"offshoreleaks.icij.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Cyrus Finance operates a native token (ticker: CYRS) available on multiple trading platforms. Price forecast data from multiple aggregators indicates a bearish trajectory for the CYRS token, with one model projecting a decrease of approximately 24.70% over the near term with a price target of $0.00003262. The token has exhibited recent daily price drops of approximately 9.8%. These metrics reflect speculative market sentiment rather than documented fundamental value and should not be interpreted as investment guidance. The protocol's promotional claims of 'stable, fixed yield' returns and smoothed LP farming volatility have not been independently verified post-exploit.","heading":"Token Economics and Market Performance","sources":[{"url":"https://coincodex.com/crypto/cyrus/price-prediction/","name":"coincodex.com","type":"other","credibility":3},{"url":"https://coinranking.com/coin/A0-K_D8rtDcjF+cyrustoken-cyrs","name":"coinranking.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"1997-09-05","event":"An entity named CYRUS FINANCE LIMITED is incorporated in the British Virgin Islands via Mossack Fonseca (Panama Papers leak data). Relation to current DeFi protocol is unconfirmed.","source":""},{"date":"2000-04-30","event":"CYRUS FINANCE LIMITED (BVI) is struck off and listed as Defaulted in offshore registry records.","source":""},{"date":"2026-01-29","event":"Domain cyrusfinance.xyz is registered. URLert later flags it as potentially malicious with a security score of 0/100.","source":""},{"date":"2026-03-12","event":"Cyrus Finance announces a partnership with DeBank for portfolio tracking, per MEXC promotional coverage.","source":""},{"date":"2026-03-22","event":"Cyrus Finance suffers a $5 million flash loan pool-shares exploit on BNB Smart Chain. No funds are recovered. PeckShield documents the incident.","source":""},{"date":"2026-04","event":"PeckShield releases its March 2026 crypto hack report noting a 96% increase in losses to $52 million, listing Cyrus Finance among the month's notable incidents.","source":"","date_original":"2026-04-01"},{"date":"2026-04-20","event":"Bankless Times publishes a report on cumulative DeFi hack losses reaching $1.7 billion in early 2026, including Cyrus Finance in a list of notable March hacks.","source":""}],"sources_used":[{"url":"https://www.mexc.co/news/966376","name":"mexc.co","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cyrus-4.gitbook.io/cyrus-docs","name":"cyrus-4.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20260604054854/https://cyrus-4.gitbook.io/cyrus-docs","credibility":3,"archive_timestamp":"2026-06-04T05:48:54+00:00"},{"url":"https://smartcontractshacking.com/hacks/cyrus-finance-hack-2026","name":"smartcontractshacking.com","type":"other","archive_url":"https://web.archive.org/web/20260829041234/https://smartcontractshacking.com/hacks/cyrus-finance-hack-2026","credibility":3,"archive_timestamp":"2026-08-29T04:12:34+00:00"},{"url":"https://www.banklesstimes.com/articles/2026/04/20/crypto-hacks-hit-1-7-billion-putting-the-defi-industry-at-risk/","name":"banklesstimes.com","type":"other","archive_url":"http://web.archive.org/web/20260519082140/https://www.banklesstimes.com/articles/2026/04/20/crypto-hacks-hit-1-7-billion-putting-the-defi-industry-at-risk/","credibility":3,"archive_timestamp":"2026-05-19T08:21:40+00:00"},{"url":"https://www.cryptotimes.io/2026/04/01/crypto-hacks-stole-52m-in-march-amid-shadow-contagion-threat-peckshield/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260830034800/https://www.cryptotimes.io/2026/04/01/crypto-hacks-stole-52m-in-march-amid-shadow-contagion-threat-peckshield/","credibility":3,"archive_timestamp":"2026-08-30T03:48:00+00:00"},{"url":"https://www.urlert.com/domains/cyrusfinance.xyz","name":"urlert.com","type":"other","archive_url":"http://web.archive.org/web/20260606053124/https://www.urlert.com/domains/cyrusfinance.xyz","credibility":3,"archive_timestamp":"2026-06-06T05:31:24+00:00"},{"url":"https://fxidea.com/cyrus-finance-otzyvy.html","name":"fxidea.com","type":"other","archive_url":"https://web.archive.org/web/20260829115135/https://fxidea.com/cyrus-finance-otzyvy.html","credibility":3,"archive_timestamp":"2026-08-29T11:51:35+00:00"},{"url":"https://mmgp.com/threads/syrusfinance-cyrusfinance-xyz-cyrusfinance-app-cyrus-finance.760559/","name":"mmgp.com","type":"other","archive_url":"http://web.archive.org/web/20260313135250/https://mmgp.com/threads/syrusfinance-cyrusfinance-xyz-cyrusfinance-app-cyrus-finance.760559/","credibility":3,"archive_timestamp":"2026-03-13T13:52:50+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"},{"url":"https://offshoreleaks.icij.org/nodes/10076447","name":"offshoreleaks.icij.org","type":"other","archive_url":"https://web.archive.org/web/20260829081552/https://offshoreleaks.icij.org/nodes/10076447","credibility":3,"archive_timestamp":"2026-08-29T08:15:52+00:00"},{"url":"https://coincodex.com/crypto/cyrus/price-prediction/","name":"coincodex.com","type":"other","archive_url":"https://web.archive.org/web/20260829025739/https://coincodex.com/crypto/cyrus/price-prediction/","credibility":3,"archive_timestamp":"2026-08-29T02:57:39+00:00"},{"url":"https://coinranking.com/coin/A0-K_D8rtDcjF+cyrustoken-cyrs","name":"coinranking.com","type":"other","archive_url":"https://web.archive.org/web/20260829030009/https://coinranking.com/coin/A0-K_D8rtDcjF+cyrustoken-cyrs","credibility":3,"archive_timestamp":"2026-08-29T03:00:09+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:17.966147+00:00","updated_at":"2026-08-30T03:54:58.432535+00:00"}}