Summary
Typus Perp is a GMX-style perpetuals DEX operating on the Sui blockchain, developed by Typus Finance (founded by Tommy Chen). On October 15, 2025, the protocol suffered a $3.44 million oracle manipulation exploit that drained its TLP liquidity pool entirely — caused by an unaudited smart contract module that was excluded from the project's May 2025 MoveBit security audit. As of May 2026, the protocol has minimal TVL ($126K) and the stolen funds have not been recovered.
Connected Entities
1 entitiesTimeline(12 events)
2022-01-01
Typus Finance founded by Tommy Chen on Sui blockchain.
2024-11-13
Vulnerable custom oracle contract package deployed to production powering the TLP pool.
2025-05-01
MoveBit security audit of Typus Finance completed. The vulnerable TLP oracle contract was excluded from audit scope.
2025-05-01
Cetus Protocol (primary Sui DEX) hacked for over $220 million — first major Sui exploit of 2025.
2025-09-01
Nemo Protocol exploited for $2.6 million via unaudited developer-deployed code — second major Sui exploit of 2025.
2025-10-15
Oracle manipulation attack begins at 13:05 UTC. Attacker exploits missing assert check in update_v2 function to manipulate prices and drain $3.44 million from the TLP pool across ten transactions.
2025-10-15
Team alerted at 13:24 UTC; all smart contracts paused at 13:39 UTC; root cause identified at 13:42 UTC; Sui Foundation notified at 13:48 UTC; law enforcement report filed at 14:54 UTC.
2025-10-15
TYPUS token falls approximately 35% from $0.009 to $0.0055 following exploit disclosure.
2025-10-15
Stolen assets bridged to Ethereum via Circle CCTP and converted to DAI on Curve.
2025-10-16
Typus Finance publishes post-mortem on Medium detailing attack timeline, vulnerability, and preliminary response plan. White hat bounty of 15% offered on-chain.
2026-01-01
Typus Finance initiates TLP Recovery Plan, requiring large LPs to submit contact information. No confirmed compensation disbursement reported.
2026-05-01
Typus Perp TVL stands at approximately $126,420 on DeFiLlama — down roughly 97% from pre-exploit levels.
Decision Log
- hash: 5QiPWMvca42GG2626q9QApZnsswfpCtfCwDi4hCRjoDh
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:15 AM
last updated: 5/26/2026, 7:54:30 PM
avoid.net — verified advice for a post-truth world