Typus Finance suffered a $3.44 million exploit due to an unaudited contract and oracle vulnerability, marking the third major hack on Sui’s DeFi ecosystem in 2025.
By Vini Barbosa
Editor Marco T. Lanz
Updated
3 mins read
Typus Finance—a perpetuals and options decentralized exchange on the Sui Network—suffered a major exploit on October 15, losing over $3 million in tokens. This is the third major exploit on the Sui SUI $2.59 24h volatility: 4.6% Market cap: $9.34 B Vol. 24h: $1.45 B DeFi ecosystem in 2025, preceded by the Cetus Protocol hack in May and the Nemo Protocol exploit in September.
A postmortem published on October 16 details the exploit, the event timeline, and the root cause, which involves an unaudited TLP contract and an oracle vulnerability regarding a lack of authority checks. Overall, the attacker drained $3.44 million worth of SUI, USDC, xBTC, and suiETH, according to the document. Precisely, Typus lost 588,357.9 SUI, 1,604,034.7 USDC, 0.6 xBTC, and 32.227 suiETH.
“Two process causes compounded this issue. First, the vulnerable oracle module, originally deployed on November 13, 2024, was not included in the scope of our May 2025 audit conducted by MoveBit. Second, the alert frequency for our on-chain monitoring service was not configured for immediate detection of this specific event type.”
While a significant exploit, only the TLP contract was affected. Funds deposited in the SAFU and DeFi Options Vaults remain secure. The team asserts that they have received active support from the Sui Foundation, Mysten Labs, MoveBit, SlowMist, and Hypernative—now working on an “asset recovery plan.”
We are now publishing our full post-mortem report on the October 15 TLP exploit.
The report details the incident timeline, root cause analysis, an impact assessment of approx. $3.44M USD, and our response plan.
We confirm that funds in our SAFU and DeFi Options Vaults were…
— Typus Finance (@TypusFinance) October 16, 2025
Before Typus Finance, two other DeFi protocols building on the Sui blockchain suffered major exploits this year.
First, CETUS Protocol—the primary decentralized exchange on Sui—suffered a major hack in May 2025, losing more than $220 million in assets, as Coinspeaker reported. In its postmortem, Cetus admitted that it was relaxed in its approach regarding vigilance, according to Cointelegraph.
What followed was a highly controversial governance vote that allowed the Sui Foundation, Cetus, and OtterSec to seize the stolen funds from the attacker’s Sui account that they had previously decided to freeze. This seizure effectively broke Sui’s cryptographic security by creating a special private key with universal signing capacity.
“If this vote passes, the next Sui release will include a protocol upgrade that enables a one-time authentication of two special transactions. These transactions will be hard-coded with the two attacker addresses, stolen asset objects, and their destination. It will verify the voting results and, if approved, transfer the stolen funds from the attacker addresses to a Cetus multi-sig wallet with Cetus, the Sui Foundation, and OtterSec acting as signers.”
Governance Vote | Source: Sui Explorer
Most recently, in September, Sui-based yield protocol Nemo was exploited for $2.4 million in USDC, according to a report from CoinDesk.
Commentators on X now criticize Typus for what some are calling “negligence” for both the lack of a proper audit and the use of an oracle without a proven track record, instead of using more consolidated products like Chainlink LINK $17.66 24h volatility: 2.6% Market cap: $12.30 B Vol. 24h: $923.96 M .
Users have a clear potential cause of action against Typus for gross negligence and misrepresentation. The decision to rely on an unproven oracle system like Pyth, despite the well-documented reliability of Chainlink, demonstrates a failure to exercise reasonable care in…
— Team Cucumber (@TeamCucumber777) October 15, 2025
These events have fueled uncertainty in a market that is still struggling to recover from the unprecedented $19 billion liquidations from October 10’s crash. As Coinspeaker reported earlier today, another $540 million in liquidations amid sell-out expectations regarding Mt. Gox repayments.
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Vini Barbosa has covered the crypto industry professionally since 2020, summing up to over 10,000 hours of research, writing, and editing related content for media outlets and key industry players. Vini is an active commentator and a heavy user of the technology, truly believing in its revolutionary potential. Topics of interest include blockchain, open-source software, decentralized finance, and real-world utility.
