{"investigation":{"slug":"typus-perp","entity_name":"Typus Perp","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Typus Perp is a GMX-style perpetuals DEX operating on the Sui blockchain, developed by Typus Finance (founded by Tommy Chen). On October 15, 2025, the protocol suffered a $3.44 million oracle manipulation exploit that drained its TLP liquidity pool entirely — caused by an unaudited smart contract module that was excluded from the project's May 2025 MoveBit security audit. As of May 2026, the protocol has minimal TVL ($126K) and the stolen funds have not been recovered.","sections":[{"content":"On October 15, 2025, Typus Perp's TLP (Typus Liquidity Pool) contract was drained of approximately $3.44 million USD in a targeted oracle manipulation attack. The attacker exploited a critical authorization flaw in the protocol's custom oracle module: the `update_v2` function called `vector::contains()` to check whether a sender's address was whitelisted, but failed to include an `assert!` statement to enforce the result. The boolean return value was silently discarded, meaning any address could update oracle prices without authorization. The attacker set one asset's oracle price to 651,548,270 and another to 1, creating an extreme price disparity. Ten separate attack transactions then drained 588,357.9 SUI, 1,604,034.7 USDC, 0.6 xBTC, and 32.227 suiETH from the pool. The attacker subsequently bridged the stolen assets to Ethereum via Circle CCTP and converted them to DAI on Curve to obscure the trail.","heading":"Oracle Manipulation Exploit — October 2025","sources":[{"url":"https://defimon.xyz/blog/typus-finance-hack-october-2025","name":"defimon.xyz","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-typus-finance-hack-october-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/is-the-move-language-secure-the-typus-permission-validation-vulnerability-755a5175f7c3","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/sui-based-typus-finance-loses-3-4-million-in-hack/","name":"unchainedcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The vulnerable oracle contract package was deployed on November 13, 2024, but was explicitly excluded from the scope of Typus Finance's May 2025 security audit conducted by MoveBit. This means the contract operated in production with user funds for approximately five months prior to the exploit without ever having undergone a formal security review. Security firm Halborn noted that this incident underscores the risk of using custom oracle implementations rather than established solutions such as Chainlink. SlowMist's post-incident analysis concluded that while the Move language offers strong object ownership primitives, no language feature can substitute for rigorous coding practices and comprehensive audit coverage of all production contracts. The fact that the vulnerable module was actively powering the TLP liquidity pool while remaining unaudited represents a material governance and risk-management failure.","heading":"Unaudited Contract — Critical Governance Failure","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-typus-finance-hack-october-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/is-the-move-language-secure-the-typus-permission-validation-vulnerability-755a5175f7c3","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/typus-finances-unaudited-contract-loses-3m-3rd-major-sui-exploit-in-2025/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/typus-finance-unaudited-contract-loses-175622463.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Typus team was alerted to the attack at 13:24 UTC and paused all smart contracts at 13:39 UTC, approximately 15 minutes after notification and 34 minutes after the first malicious transaction. The team subsequently reported the incident to the Sui Foundation at 13:48 UTC and filed a report with law enforcement at 14:54 UTC. Typus Finance sent an on-chain message to the attacker's Ethereum address offering a 15% white hat bounty in exchange for return of 85% of stolen funds, with a commitment not to pursue legal action. As of early 2026, the team initiated a TLP Recovery Plan, requiring liquidity providers holding 7,643 or more TLP tokens (approximately $10,000 USD at time of incident) to submit contact information. No formal compensation announcement with confirmed fund sources had been made as of available reporting. The protocol's TVL as of May 2026 stands at approximately $126,420 on DeFiLlama, a dramatic reduction from the pre-exploit level of over $3.67 million.","heading":"Team Response and Recovery Status","sources":[{"url":"https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b","name":"medium.com","type":"other","credibility":3},{"url":"https://getfailsafe.com/typus-finance-smart-contract-exploit","name":"getfailsafe.com","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/7b951b0a-2ccb-4397-9d33-27594669ffdb","name":"panewslab.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/typus-perp","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following disclosure of the exploit, the TYPUS token declined approximately 35% within hours, falling from $0.009 to $0.0055. This decline was substantially larger than concurrent broader market movements, indicating a market repricing of protocol-specific risk. The protocol's cumulative trading volume since inception stands at $273.21 million, but current 30-day volume as of May 2026 is approximately $172,944 — a fraction of pre-exploit activity levels — and annualized fees have fallen to approximately $16,787. Holders revenue is reported as $0 across all timeframes on DeFiLlama.","heading":"Market Impact","sources":[{"url":"https://www.bitget.com/news/detail/12560605016676","name":"bitget.com","type":"other","credibility":3},{"url":"https://crypto.news/sui-based-typus-finance-plummets-35-after-oracle-exploit/","name":"crypto.news","type":"other","credibility":3},{"url":"https://defillama.com/protocol/typus-perp","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Typus Finance exploit was the third major security incident on the Sui blockchain in 2025. The first was the Cetus Protocol hack in May 2025, in which the primary Sui DEX lost over $220 million. The second was the Nemo Protocol exploit in September 2025, where an alleged developer deployed unaudited code, resulting in a $2.6 million loss. The Typus incident brought total Sui DeFi losses in 2025 to over $225 million, drawing significant scrutiny to the security posture of protocols building on the Sui Move virtual machine. Security analysts noted that while the Move language provides strong foundational access control primitives, these do not substitute for complete audit coverage and correct implementation of authorization patterns.","heading":"Broader Sui Ecosystem Context","sources":[{"url":"https://www.coinspeaker.com/typus-finances-unaudited-contract-loses-3m-3rd-major-sui-exploit-in-2025/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/is-the-move-language-secure-the-typus-permission-validation-vulnerability-755a5175f7c3","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/typus-finance-unaudited-contract-loses-175622463.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Typus Finance was founded by Tommy Chen in 2022 and is described as real-yield infrastructure on the Sui blockchain. The broader Typus Finance suite includes DeFi Options Vaults (DOV), a SAFU insurance fund product, and Typus Perp — the perpetuals DEX. Investors include Assembly Partners and Hyperithm. As of early 2026, the team comprises approximately nine employees. Typus Perp uses a GMX-style peer-to-pool model (rather than an order book), with the TLP pool accepting SUI, USDC, DEEP, and LBTC as underlying assets. The protocol integrates Pyth oracle in its current post-exploit deployment, replacing the custom oracle that was exploited.","heading":"Protocol Background and Team","sources":[{"url":"https://tracxn.com/d/companies/typusfinance/__mix5JBo-wW80iKTHgL1LgtIIZ2iOtFPfBxBkThKSsHM","name":"tracxn.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/typus-perp","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/txxg1638","name":"panewslab.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022","event":"Typus Finance founded by Tommy Chen on Sui blockchain.","source":"","date_original":"2022-01-01"},{"date":"2024-11-13","event":"Vulnerable custom oracle contract package deployed to production powering the TLP pool.","source":""},{"date":"2025-05","event":"MoveBit security audit of Typus Finance completed. The vulnerable TLP oracle contract was excluded from audit scope.","source":"","date_original":"2025-05-01"},{"date":"2025-05","event":"Cetus Protocol (primary Sui DEX) hacked for over $220 million — first major Sui exploit of 2025.","source":"","date_original":"2025-05-01"},{"date":"2025-09","event":"Nemo Protocol exploited for $2.6 million via unaudited developer-deployed code — second major Sui exploit of 2025.","source":"","date_original":"2025-09-01"},{"date":"2025-10-15","event":"Oracle manipulation attack begins at 13:05 UTC. Attacker exploits missing assert check in update_v2 function to manipulate prices and drain $3.44 million from the TLP pool across ten transactions.","source":""},{"date":"2025-10-15","event":"Team alerted at 13:24 UTC; all smart contracts paused at 13:39 UTC; root cause identified at 13:42 UTC; Sui Foundation notified at 13:48 UTC; law enforcement report filed at 14:54 UTC.","source":""},{"date":"2025-10-15","event":"TYPUS token falls approximately 35% from $0.009 to $0.0055 following exploit disclosure.","source":""},{"date":"2025-10-15","event":"Stolen assets bridged to Ethereum via Circle CCTP and converted to DAI on Curve.","source":""},{"date":"2025-10-16","event":"Typus Finance publishes post-mortem on Medium detailing attack timeline, vulnerability, and preliminary response plan. White hat bounty of 15% offered on-chain.","source":""},{"date":"2026","event":"Typus Finance initiates TLP Recovery Plan, requiring large LPs to submit contact information. No confirmed compensation disbursement reported.","source":"","date_original":"2026-01-01"},{"date":"2026-05","event":"Typus Perp TVL stands at approximately $126,420 on DeFiLlama — down roughly 97% from pre-exploit levels.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://defimon.xyz/blog/typus-finance-hack-october-2025","name":"defimon.xyz","type":"other","archive_url":"http://web.archive.org/web/20260612135942/https://defimon.xyz/blog/typus-finance-hack-october-2025","credibility":3,"archive_timestamp":"2026-06-12T13:59:42+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-typus-finance-hack-october-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260609205020/https://www.halborn.com/blog/post/explained-the-typus-finance-hack-october-2025","credibility":3,"archive_timestamp":"2026-06-09T20:50:20+00:00"},{"url":"https://slowmist.medium.com/is-the-move-language-secure-the-typus-permission-validation-vulnerability-755a5175f7c3","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251025021558/https://slowmist.medium.com/is-the-move-language-secure-the-typus-permission-validation-vulnerability-755a5175f7c3","credibility":3,"archive_timestamp":"2025-10-25T02:15:58+00:00"},{"url":"https://unchainedcrypto.com/sui-based-typus-finance-loses-3-4-million-in-hack/","name":"unchainedcrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251016185629/https://unchainedcrypto.com/sui-based-typus-finance-loses-3-4-million-in-hack/","credibility":3,"archive_timestamp":"2025-10-16T18:56:29+00:00"},{"url":"https://www.coinspeaker.com/typus-finances-unaudited-contract-loses-3m-3rd-major-sui-exploit-in-2025/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20260520043856/https://www.coinspeaker.com/typus-finances-unaudited-contract-loses-3m-3rd-major-sui-exploit-in-2025/","credibility":3,"archive_timestamp":"2026-05-20T04:38:56+00:00"},{"url":"https://finance.yahoo.com/news/typus-finance-unaudited-contract-loses-175622463.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20251204084018/https://finance.yahoo.com/news/typus-finance-unaudited-contract-loses-175622463.html","credibility":3,"archive_timestamp":"2025-12-04T08:40:18+00:00"},{"url":"https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251114215958/https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b","credibility":3,"archive_timestamp":"2025-11-14T21:59:58+00:00"},{"url":"https://getfailsafe.com/typus-finance-smart-contract-exploit","name":"getfailsafe.com","type":"other","archive_url":"http://web.archive.org/web/20260212011923/https://getfailsafe.com/typus-finance-smart-contract-exploit","credibility":3,"archive_timestamp":"2026-02-12T01:19:23+00:00"},{"url":"https://www.panewslab.com/en/articles/7b951b0a-2ccb-4397-9d33-27594669ffdb","name":"panewslab.com","type":"other","archive_url":"http://web.archive.org/web/20251219222629/https://www.panewslab.com/en/articles/7b951b0a-2ccb-4397-9d33-27594669ffdb","credibility":3,"archive_timestamp":"2025-12-19T22:26:29+00:00"},{"url":"https://defillama.com/protocol/typus-perp","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250909122708/https://defillama.com/protocol/typus-perp","credibility":3,"archive_timestamp":"2025-09-09T12:27:08+00:00"},{"url":"https://www.bitget.com/news/detail/12560605016676","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829083440/https://www.bitget.com/news/detail/12560605016676","credibility":3,"archive_timestamp":"2026-08-29T08:34:40+00:00"},{"url":"https://crypto.news/sui-based-typus-finance-plummets-35-after-oracle-exploit/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251119101947/https://crypto.news/sui-based-typus-finance-plummets-35-after-oracle-exploit/","credibility":3,"archive_timestamp":"2025-11-19T10:19:47+00:00"},{"url":"https://tracxn.com/d/companies/typusfinance/__mix5JBo-wW80iKTHgL1LgtIIZ2iOtFPfBxBkThKSsHM","name":"tracxn.com","type":"other","archive_url":"https://web.archive.org/web/20260911053359/https://tracxn.com/d/companies/typus-finance/__mix5JBo-wW80iKTHgL1LgtIIZ2iOtFPfBxBkThKSsHM#competitors-and-alternates","credibility":3,"archive_timestamp":"2026-09-11T05:33:59+00:00"},{"url":"https://www.panewslab.com/en/articles/txxg1638","name":"panewslab.com","type":"other","archive_url":"http://web.archive.org/web/20251106031949/https://www.panewslab.com/en/articles/txxg1638","credibility":3,"archive_timestamp":"2025-11-06T03:19:49+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.327299+00:00","updated_at":"2026-09-11T05:36:59.677883+00:00"}}