Verify a decision

{"actor":"system:backfill","investigation_id":"387ed05b-91c6-4dc9-9195-af8cc69d4052","kind":"publish","page_slug":"sirio-finance","published_at":"2026-05-28T02:26:59.795Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sirio Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://genfinity.io/2025/01/27/sirio-finance-mainnet-launch/","type":"other","url":""},{"credibility":3,"name":"https://hedera.com/blog/leveraging-hederas-architecture-sirios-oracle-free-price-feed-approach","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/sirio-finance","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886000535628825027","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886066175177888071","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.quillaudits.com/leaderboard/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1887577062682337425","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/SirioFinance/status/1887577062682337425","type":"other","url":""},{"credibility":3,"name":"https://x.com/SirioFinance/status/1886000535628825027","type":"other","url":""},{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/sirio/","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/sirio","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://allincrypto.com/ai-driven-defi-protocol-on-hedera-hbar-hacked-millions/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/sirio-finance","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/leaderboard/sirio-finance","type":"other","url":""}]}],"sources_used":[],"summary":"Sirio Finance is a DeFAI lending and borrowing protocol built on the Hedera blockchain that launched on January 27, 2025 and suffered a flashloan exploit on February 1, 2025, resulting in an estimated $2–3 million in stolen funds. The exploit occurred within five days of mainnet launch, with post-incident analysis indicating the vulnerability was introduced when the team followed an audit directive from QuillAudits to remove a reentrancy guard from the protocol's smart contracts. The protocol's TVL collapsed to near zero following the hack, and no confirmed recovery of stolen funds or full user compensation has been publicly documented.","timeline":[{"date":"2025-01-27","event":"Sirio Finance launches its mainnet DeFAI lending and borrowing protocol on the Hedera blockchain, becoming the first lending protocol on the network.","source":""},{"date":"2025-01-29","event":"Sirio Finance reports reaching a $1.5 million TVL milestone, citing strong early user adoption.","source":""},{"date":"2025-02-01","event":"Sirio Finance is exploited via three flashloan attacks executed through Bonzo Finance. The HSUITE pool is specifically compromised. Estimated $2–3 million is stolen. Smart contracts are immediately frozen.","source":""},{"date":"2025-02-03","event":"Sirio Finance team states it is collaborating with the Hedera Foundation, using Elliptic and TRM Labs to track stolen funds, and has attempted to contact the attacker via multiple addresses with a whitehat recovery offer.","source":""},{"date":"2025-02-04","event":"Sirio Finance team provides community update on three key areas: Stolen Funds Tracking, Withdrawal of Left Funds, and the Recovery Program. Reports submission of complaint to CSIRT and contact established with Binance via Seal911 ticket.","source":""},{"date":"2025-02-04","event":"Post-incident analysis indicates the critical vulnerability was introduced when the protocol followed a QuillAudits audit directive to remove a reentrancy guard. Sirio Finance team publicly disassociates from QuillAudits.","source":""}]},"v":1}