{"investigation":{"slug":"tropykus-rsk","entity_name":"Tropykus RSK","trust_score":32,"severity_base":null,"score_modifier":-12,"confidence":0.62,"status":"published","content_type":"investigation","summary":"Tropykus is a DeFi lending and borrowing protocol deployed on the Rootstock (RSK) Bitcoin sidechain, founded in 2021 by a Colombian team targeting Latin American underbanked communities. On June 14, 2023, the protocol suffered an exploit in its rBTC micro-market due to a redeem rounding error and exchange rate manipulation, resulting in losses of approximately $150,000 — roughly 10% of total value locked at the time. The team committed to full reimbursement of affected users and subsequently reverted to Compound Finance's original codebase, but the incident highlighted unresolved smart contract risks in a customized fork.","sections":[{"content":"Tropykus is an algorithmic, non-custodial lending and borrowing protocol built on Rootstock (RSK), an EVM-compatible Bitcoin sidechain secured by Bitcoin's proof-of-work via merge-mining. The protocol is a fork of Compound Finance's codebase, adapted for Latin American users with a focus on Bitcoin-collateralized loans and stablecoin savings. Supported assets include RBTC (wrapped Bitcoin on RSK), DOC (Dollar on Chain), RIF, and rUSDT, with interest rates set dynamically by supply-and-demand smart contracts. The protocol launched on RSK testnet in April 2021 and reached mainnet in May 2021, later expanding to Polygon zkEVM in May 2023.","heading":"Protocol Overview","sources":[{"url":"https://defillama.com/protocol/tropykus-rsk","name":"Tropykus RSK — DefiLlama Protocol Page","type":"research","credibility":2},{"url":"https://helpdesk.rootstock.io/solutions/tropykus.html","name":"Rootstock Helpdesk: Tropykus","type":"official","credibility":2},{"url":"https://github.com/Tropykus/protocol-rsk","name":"Tropykus Finance — GitHub Repository","type":"official","credibility":2},{"url":"https://rootstock.io/blog/becoming-a-bitcoiner-in-the-defi-world/","name":"Becoming a Bitcoiner in the DeFi World — Rootstock Blog","type":"official","credibility":2}],"severity":"low"},{"content":"On June 14, 2023, Tropykus suffered a targeted attack on its rBTC micro-market, a custom market offering approximately 3% yield that was not part of Compound Finance's original codebase. The attacker exploited a redeem rounding error vulnerability to manipulate the exchange rate within that market, enabling withdrawal of more funds than legitimately entitled and the use of a flash loan in stablecoins. The team reported losses of approximately $150,000, representing roughly 10% of total deposits at the time. Tropykus identified two attacker-controlled addresses and reported them to relevant parties to flag them across other chains. The platform was temporarily taken offline as a containment measure. Tropykus issued a deadline of June 16, 2023 at 23:59 GMT-5 for the attacker to contact them before initiating legal proceedings, and offered the attacker the $50,000 bug bounty reward available on Immunefi had they disclosed the vulnerability responsibly. No public confirmation of fund recovery has been verified.","heading":"June 2023 Exploit: rBTC Micro-Market Rounding Error","sources":[{"url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/","name":"La Plataforma DeFi Tropykus Sufre Un Exploit De 150.000 Dolares — Criptotendencias","type":"news_article","credibility":2},{"url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/","name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","credibility":2},{"url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa","name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","credibility":3},{"url":"https://defillama.com/hacks","name":"DeFi Hacks Database — DefiLlama","type":"research","credibility":2}],"severity":"high"},{"content":"Following the exploit, Tropykus co-founder Diego Mazo publicly addressed the incident in a video session with crypto community leaders. The team pledged to reimburse 100% of the stablecoins lost and 100% of the Bitcoin lost at a fixed reference price of $30,000 per BTC. The protocol reverted to Compound Finance's unmodified original codebase, discontinuing the vulnerable rBTC micro-market that had been a custom addition. New product offerings, including Bitcoin Pro (BPro) and RifUSD markets, were subsequently launched. The team described the incident as deeply disappointing given the existence of a public bug bounty program through Immunefi, which offered up to $50,000 for critical vulnerability disclosures. No independent audit of the post-exploit remediation has been publicly verified as of the date of this investigation.","heading":"Team Response and Remediation","sources":[{"url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa","name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","credibility":3},{"url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/","name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","credibility":2},{"url":"https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program","name":"HackenProof: Tropykus Bug Bounty Program","type":"official","credibility":2}],"severity":"medium"},{"content":"The Tropykus exploit is classified as a protocol logic vulnerability — specifically, a rounding error in a custom redemption mechanism that was not present in Compound Finance's original codebase. This illustrates a common risk category for Compound forks: teams add custom market types or yield strategies without full security review of the incremental code changes. On the RSK deployment, the protocol did not specify the use of a third-party oracle provider for the exploited market; the rBTC micro-market's internal exchange rate mechanism was the attack vector. On its Polygon zkEVM expansion (May 2023), Tropykus integrated API3's self-funded dAPIs for price feeds, which carry their own oracle liveness and data-quality risks. The prior existence of an Immunefi bug bounty did not prevent the exploit, as the attacker did not participate in the bounty program. No formal Tier 1 security audit reports have been located by this investigation.","heading":"Smart Contract and Oracle Risk Profile","sources":[{"url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8","name":"Tropykus to Launch on Polygon zkEVM Using API3 Data Feeds — API3 Medium","type":"news_article","credibility":2},{"url":"https://extropy-io.medium.com/rounding-errors-minor-but-major-hacks-445dc9996ecc","name":"Rounding Errors: Minor but Major Hacks — Extropy.IO Medium","type":"research","credibility":2},{"url":"https://firebasestorage.googleapis.com/v0/b/tropycofinance.appspot.com/o/Tropykus_Protocol%20V4.pdf?alt=media&token=8667d3a7-cdc2-46f2-b35f-5e82bb407b02","name":"Tropykus Finance Protocol Whitepaper (Firebase PDF)","type":"official","credibility":2},{"url":"https://f.hubspotusercontent30.net/hubfs/21211885/Documentos%20PDF/Tropykus%20Finance%20-%20Quant%20Assesment%20version%202.pdf","name":"Market Risk Assessment of Tropykus Financial Protocol (HubSpot PDF)","type":"research","credibility":2}],"severity":"high"},{"content":"Tropykus Finance was founded in 2021 by Mauricio Tovar (CEO), Mesi Rendon (CTO), and Diego Mazo. The company is incorporated as a crypto and financial services startup with a stated focus on Latin America's underbanked populations. The protocol has raised $700,000 from investors including Outlier Ventures, Pomp Investments, and RootstockLabs. Outlier Ventures maintains a public portfolio page listing Tropykus. The founding team has been publicly visible, with Diego Mazo speaking on the record following the June 2023 exploit. The protocol initially targeted Colombia and other Latin American markets, with plans for local currency integration. No regulatory actions or government investigations have been identified against the entity or its founders as of this investigation.","heading":"Team, Investors, and Organizational Background","sources":[{"url":"https://www.crunchbase.com/organization/tropykus-finance","name":"Tropykus Finance — Crunchbase Company Profile","type":"other","credibility":2},{"url":"https://outlierventures.io/portfolio/tropykus/","name":"Tropykus — Outlier Ventures Portfolio","type":"official","credibility":2},{"url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/","name":"Tropykus Finance — RootstockLabs Blog","type":"news_article","credibility":2},{"url":"https://tracxn.com/d/companies/tropykus/__d45iyYN5-yD6ugvnyVJ2tq-kCj38Thbr4TDzewjsKqs/funding-and-investors","name":"Tropykus Finance — Tracxn Funding Profile","type":"other","credibility":2}],"severity":"low"},{"content":"Tropykus RSK was flagged as a ZachXBT-investigated entity in the intake for this investigation. However, multiple targeted web searches — including queries combining 'Tropykus' with 'ZachXBT,' his known publishing platforms (mirror.xyz, zachxbt.com), and his social media accounts — returned no verifiable posts, threads, or investigations by ZachXBT specifically addressing Tropykus RSK. The June 2023 exploit has been documented by Spanish-language crypto news outlets and community Medium posts, but no Tier 1 or Tier 2 English-language source connecting ZachXBT to a Tropykus investigation has been located. This section is flagged as low confidence. If ZachXBT referenced Tropykus in a Telegram post, direct X (Twitter) reply, or private channel, that content is not publicly indexed. Readers should treat the ZachXBT association as alleged and unverified until a primary source is produced.","heading":"ZachXBT Association: Evidence Assessment","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"ZachXBT — Wikipedia","type":"other","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2021-04","event":"Tropykus launches on Rootstock (RSK) testnet.","source":"RootstockLabs Blog","source_url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/","date_original":"2021-04-01"},{"date":"2021-05","event":"Tropykus mainnet deployment on Rootstock goes live, supporting RBTC, DOC, RIF, and USDT markets.","source":"Rootstock Blog","source_url":"https://rootstock.io/blog/becoming-a-bitcoiner-in-the-defi-world/","date_original":"2021-05-01"},{"date":"2023-05-24","event":"Tropykus deploys experimental version on Polygon zkEVM, integrating API3 self-funded dAPIs for price oracles.","source":"API3 Medium / Cointelegraph ES","source_url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8"},{"date":"2023-06-14","event":"Tropykus RSK suffers a $150,000 exploit targeting the rBTC micro-market via a redeem rounding error and exchange rate manipulation. Approximately 10% of total deposits are drained.","source":"BeinCrypto ES / Criptotendencias","source_url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"date":"2023-06-14","event":"Tropykus temporarily disables the platform and identifies two attacker wallet addresses, flagging them across chains.","source":"Criptotendencias","source_url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/"},{"date":"2023-06-16","event":"Tropykus sets a 23:59 GMT-5 deadline for the attacker to contact them before pursuing legal action, referencing the $50,000 Immunefi bug bounty as an alternative.","source":"BeinCrypto ES","source_url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/"},{"date":"2023-07","event":"Tropykus publicly commits to full reimbursement of all user losses; removes the rBTC micro-market and reverts protocol to Compound Finance's original codebase.","source":"Medium — Tropikus Exploit Aftermath Report","source_url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa","date_original":"2023-07-01"},{"date":"2023-09-18","event":"Tropykus Finance closes a venture funding round, raising $700,000 total from Outlier Ventures, Pomp Investments, and RootstockLabs.","source":"Crunchbase / Tracxn","source_url":"https://www.crunchbase.com/organization/tropykus-finance/company_financials"}],"sources_used":[{"url":"https://defillama.com/protocol/tropykus-rsk","name":"Tropykus RSK — DefiLlama","type":"research","archive_url":"http://web.archive.org/web/20250814171619/https://defillama.com/protocol/tropykus-rsk","credibility":2,"archive_timestamp":"2025-08-14T17:16:19+00:00"},{"url":"https://defillama.com/protocol/tropykus-finance","name":"Tropykus Finance — DefiLlama","type":"research","archive_url":"http://web.archive.org/web/20250909143811/https://defillama.com/protocol/tropykus-finance","credibility":2,"archive_timestamp":"2025-09-09T14:38:11+00:00"},{"url":"https://es.beincrypto.com/tropykus-finance-sufre-exploit-150000-10-porciento-depositos/","name":"Tropykus Finance sufre exploit por $150,000 — BeinCrypto ES","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/","name":"La Plataforma DeFi Tropykus Sufre Un Exploit De 150.000 Dolares — Criptotendencias","type":"news_article","archive_url":"http://web.archive.org/web/20260512131755/https://www.criptotendencias.com/defi/tropykus-defi-exploit-hackers/","credibility":2,"archive_timestamp":"2026-05-12T13:17:55+00:00"},{"url":"https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa","name":"Tropikus Report: Aftermath of the Exploit — Medium","type":"community_report","archive_url":"https://web.archive.org/web/20260724172423/https://medium.com/@IndependentAcademy/tropikus-report-aftermath-of-the-exploit-a0118ee43eaa","credibility":3,"archive_timestamp":"2026-07-24T17:24:23+00:00"},{"url":"https://github.com/Tropykus/protocol-rsk","name":"Tropykus Finance — GitHub","type":"official","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://outlierventures.io/portfolio/tropykus/","name":"Tropykus — Outlier Ventures Portfolio","type":"official","archive_url":"http://web.archive.org/web/20260421200422/https://outlierventures.io/portfolio/tropykus/","credibility":2,"archive_timestamp":"2026-04-21T20:04:22+00:00"},{"url":"https://www.crunchbase.com/organization/tropykus-finance","name":"Tropykus Finance — Crunchbase","type":"other","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/api3/tropykus-to-launch-on-polygon-zkevm-using-api3s-data-feeds-710fdc29b1c8","name":"Tropykus to Launch on Polygon zkEVM Using API3 Data Feeds — API3 Medium","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/","name":"RootstockLabs Blog: Tropykus Finance DeFi en Bitcoin con Impacto Social","type":"news_article","archive_url":"http://web.archive.org/web/20260510120155/https://www.rootstocklabs.com/blog/tropykus-finance-defi-en-bitcoin-con-impacto-social/","credibility":2,"archive_timestamp":"2026-05-10T12:01:55+00:00"},{"url":"https://helpdesk.rootstock.io/solutions/tropykus.html","name":"Rootstock Helpdesk: Tropykus","type":"official","archive_url":"http://web.archive.org/web/20260414054516/https://helpdesk.rootstock.io/solutions/tropykus.html","credibility":2,"archive_timestamp":"2026-04-14T05:45:16+00:00"},{"url":"https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program","name":"HackenProof: Tropykus Bug Bounty Program","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tracxn.com/d/companies/tropykus/__d45iyYN5-yD6ugvnyVJ2tq-kCj38Thbr4TDzewjsKqs/funding-and-investors","name":"Tropykus Finance — Tracxn Funding Profile","type":"other","archive_url":"https://web.archive.org/web/20260724211336/https://tracxn.com/d/companies/tropykus/__d45iyYN5-yD6ugvnyVJ2tq-kCj38Thbr4TDzewjsKqs/funding-and-investors#investors","credibility":2,"archive_timestamp":"2026-07-24T21:13:36+00:00"},{"url":"https://www.altcoinbuzz.io/defi/tropykus-and-emerging-economies/","name":"Tropykus — Altcoin Buzz DeFi Overview","type":"news_article","archive_url":"http://web.archive.org/web/20250914022046/https://www.altcoinbuzz.io/defi/tropykus-and-emerging-economies/","credibility":3,"archive_timestamp":"2025-09-14T02:20:46+00:00"},{"url":"https://extropy-io.medium.com/rounding-errors-minor-but-major-hacks-445dc9996ecc","name":"Rounding Errors: Minor but Major Hacks — Extropy.IO Medium","type":"research","archive_url":"http://web.archive.org/web/20251013085502/https://extropy-io.medium.com/rounding-errors-minor-but-major-hacks-445dc9996ecc","credibility":2,"archive_timestamp":"2025-10-13T08:55:02+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:41.359659+00:00","updated_at":"2026-08-29T01:35:42.732+00:00"}}