{"investigation":{"slug":"sirio-finance","entity_name":"Sirio Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Sirio Finance is a DeFAI lending and borrowing protocol built on the Hedera blockchain that launched on January 27, 2025 and suffered a flashloan exploit on February 1, 2025, resulting in an estimated $2–3 million in stolen funds. The exploit occurred within five days of mainnet launch, with post-incident analysis indicating the vulnerability was introduced when the team followed an audit directive from QuillAudits to remove a reentrancy guard from the protocol's smart contracts. The protocol's TVL collapsed to near zero following the hack, and no confirmed recovery of stolen funds or full user compensation has been publicly documented.","sections":[{"content":"Sirio Finance describes itself as the first DeFAI (Decentralized Finance with AI) lending and borrowing protocol built on the Hedera network. The platform incorporated a machine learning model intended to assess loan risk and reduce liquidation events by analyzing market conditions, liquidity, and volatility across more than 20 features. Core product functions included supply, withdraw, borrow, and repay of assets, with variable interest rates (APY) offered to depositors. The protocol featured an oracle-free price feed system using Time-Weighted Average Price (TWAP) methodology and partnered with Filecoin for decentralized data storage. Supported wallets included HashPack and Kabila. Sirio Finance's native token trades under the ticker SIR.","heading":"Overview","sources":[{"url":"https://genfinity.io/2025/01/27/sirio-finance-mainnet-launch/","name":"genfinity.io","type":"other","credibility":3},{"url":"https://hedera.com/blog/leveraging-hederas-architecture-sirios-oracle-free-price-feed-approach","name":"hedera.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/sirio-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/sirio-finance","name":"dappradar.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 1, 2025, approximately five days after the protocol's mainnet launch on January 27, 2025, Sirio Finance suffered a flashloan exploit. The attacker executed three flash loan attacks via Bonzo Finance — another lending protocol on Hedera — and then borrowed and withdrew assets from Sirio Finance's pools. The HSUITE pool was specifically identified as impacted. Estimated losses range from $2 million to $3 million, though the Sirio Finance team did not confirm exact figures publicly. The attack is classified as a protocol logic exploit facilitated by a flashloan technique. Following discovery, the team immediately froze all smart contracts. Criticism emerged from HBAR investors suggesting the team had rushed the protocol launch without adequate security precautions.","heading":"February 2025 Flashloan Exploit","sources":[{"url":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","name":"allincrypto.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/sirio-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://x.com/SirioFinance/status/1886000535628825027","name":"x.com","type":"other","credibility":3},{"url":"https://x.com/SirioFinance/status/1886066175177888071","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Sirio Finance was audited by QuillAudits prior to launch. Post-incident analysis and community reporting indicated that the critical vulnerability exploited in the February 2025 attack was introduced as a direct result of an audit directive from QuillAudits, which instructed the Sirio Finance team to remove a reentrancy guard present in the protocol's smart contracts. QuillAudits characterized this in their post-mortem as an 'oversight.' The Sirio Finance team publicly disassociated from QuillAudits, alleging the audit firm's response was focused on reputation protection rather than collaborative fund recovery. Community members and security researchers criticized QuillAudits for avoiding accountability, blocking complaints from affected parties, and admitting no fault. The incident drew attention to the protocol's choice of QuillAudits over more established audit firms such as CertiK, Trail of Bits, or PeckShield.","heading":"Audit Failure and QuillAudits Controversy","sources":[{"url":"https://www.quillaudits.com/leaderboard/sirio-finance","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","name":"allincrypto.com","type":"other","credibility":3},{"url":"https://x.com/SirioFinance/status/1887577062682337425","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the Sirio Finance team stated they would maintain transparency with the community. Key actions reported by the team include: (1) freezing all smart contracts immediately upon discovery; (2) engaging the Hedera Foundation and Hashgraph Association to assist in assessing the damage; (3) deploying blockchain analytics firms Elliptic and TRM Labs to trace stolen funds; (4) submitting a formal report to CSIRT (Computer Security Incident Response Team, described as the highest local cybersecurity authority), which confirmed receipt of the complaint; (5) opening a Seal911 ticket through which contact was established with Binance, as the attacker allegedly used Binance liquidity via ChangeNow to perform asset swaps; and (6) attempting to contact the attacker via multiple wallet addresses to propose a whitehat arrangement in which stolen funds could be returned in exchange for avoiding law enforcement involvement. The team stated it had taken a snapshot of user balances ('benevolent users') as part of a planned fund redistribution strategy. The team expressed commitment not to abandon the community but no confirmed full user compensation or fund recovery has been publicly documented.","heading":"Team Response and Recovery Efforts","sources":[{"url":"https://x.com/SirioFinance/status/1887577062682337425","name":"x.com","type":"other","credibility":3},{"url":"https://x.com/SirioFinance/status/1886000535628825027","name":"x.com","type":"other","credibility":3},{"url":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","name":"allincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of available data, Sirio Finance's total value locked (TVL) stands at approximately $23,287, with $0 in active loans, representing a near-total collapse from the pre-hack TVL. The protocol had reported a 1.5 million USD TVL milestone on January 29, 2025, just days before the exploit. The protocol's token (SIR) trades at extremely low values, with market capitalization reported at approximately $548,163 and price in the micro-cent range across multiple tracking platforms. The protocol remains listed on DappRadar and DefiLlama but shows minimal user activity. The Sirio Finance website and social media remain active, with the team discussing ongoing recovery planning.","heading":"Current Protocol Status and TVL","sources":[{"url":"https://defillama.com/protocol/sirio-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/sirio-finance","name":"dappradar.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/sirio/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/sirio","name":"coinbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Several risk factors are associated with Sirio Finance: (1) The protocol suffered a critical exploit within five days of mainnet launch, raising questions about pre-launch security diligence. (2) The reentrancy guard removal, allegedly directed by the protocol's own auditor QuillAudits, represents a failure of the security review process. (3) The team's identity and domicile have not been prominently disclosed in available sources, limiting accountability. (4) No confirmed full recovery of user funds has been publicly documented, and the whitehat proposal to the attacker appears to have been unsuccessful. (5) TVL remains near zero, indicating lack of user confidence in the protocol post-hack. (6) The SIR token trades at a near-zero price with very limited liquidity. ZachXBT has flagged the entity, though the specific nature of that flagging is based on the platform's internal trust assessment rather than a publicly documented investigation post.","heading":"Risk Factors","sources":[{"url":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","name":"allincrypto.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/sirio-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/leaderboard/sirio-finance","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-01-27","event":"Sirio Finance launches its mainnet DeFAI lending and borrowing protocol on the Hedera blockchain, becoming the first lending protocol on the network.","source":""},{"date":"2025-01-29","event":"Sirio Finance reports reaching a $1.5 million TVL milestone, citing strong early user adoption.","source":""},{"date":"2025-02","event":"Sirio Finance is exploited via three flashloan attacks executed through Bonzo Finance. The HSUITE pool is specifically compromised. Estimated $2–3 million is stolen. Smart contracts are immediately frozen.","source":"","date_original":"2025-02-01"},{"date":"2025-02-03","event":"Sirio Finance team states it is collaborating with the Hedera Foundation, using Elliptic and TRM Labs to track stolen funds, and has attempted to contact the attacker via multiple addresses with a whitehat recovery offer.","source":""},{"date":"2025-02-04","event":"Sirio Finance team provides community update on three key areas: Stolen Funds Tracking, Withdrawal of Left Funds, and the Recovery Program. Reports submission of complaint to CSIRT and contact established with Binance via Seal911 ticket.","source":""},{"date":"2025-02-04","event":"Post-incident analysis indicates the critical vulnerability was introduced when the protocol followed a QuillAudits audit directive to remove a reentrancy guard. Sirio Finance team publicly disassociates from QuillAudits.","source":""}],"sources_used":[{"url":"https://genfinity.io/2025/01/27/sirio-finance-mainnet-launch/","name":"genfinity.io","type":"other","archive_url":"https://web.archive.org/web/20260829033214/https://genfinity.io/2025/01/27/sirio-finance-mainnet-launch/","credibility":3,"archive_timestamp":"2026-08-29T03:32:14+00:00"},{"url":"https://hedera.com/blog/leveraging-hederas-architecture-sirios-oracle-free-price-feed-approach","name":"hedera.com","type":"other","archive_url":"http://web.archive.org/web/20260419235113/https://hedera.com/blog/leveraging-hederas-architecture-sirios-oracle-free-price-feed-approach/","credibility":3,"archive_timestamp":"2026-04-19T23:51:13+00:00"},{"url":"https://defillama.com/protocol/sirio-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250913234604/https://defillama.com/protocol/sirio-finance","credibility":3,"archive_timestamp":"2025-09-13T23:46:04+00:00"},{"url":"https://dappradar.com/dapp/sirio-finance","name":"dappradar.com","type":"other","archive_url":"https://web.archive.org/web/20260829075209/https://dappradar.com/dapp/sirio-finance","credibility":3,"archive_timestamp":"2026-08-29T07:52:09+00:00"},{"url":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","name":"allincrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829112123/https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","credibility":3,"archive_timestamp":"2026-08-29T11:21:23+00:00"},{"url":"https://x.com/SirioFinance/status/1886000535628825027","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/SirioFinance/status/1886066175177888071","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.quillaudits.com/leaderboard/sirio-finance","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260829051828/https://www.quillaudits.com/leaderboard/sirio-finance","credibility":3,"archive_timestamp":"2026-08-29T05:18:28+00:00"},{"url":"https://x.com/SirioFinance/status/1887577062682337425","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/sirio/","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260829113002/https://coinmarketcap.com/currencies/sirio/","credibility":3,"archive_timestamp":"2026-08-29T11:30:02+00:00"},{"url":"https://www.coinbase.com/price/sirio","name":"coinbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:25.841088+00:00","updated_at":"2026-08-29T12:34:20.087701+00:00"}}