Key Highlights:
- Typus Finance confirms that all collateral on paused perpetuals are safe, with liquidation halted.
- Internal vulnerability fix completed, platform will be relaunched after third-party security review.
- Fund tracing and asset recovery is still ongoing.
Typus Finance, a decentralized derivatives platform, has addressed the users to calm them after pausing perpetual contact trading earlier this week. The platform experienced a security issue due to which this step was initiated. On the official X (formerly known as Twitter) page of the platform, the team addressed the concerns about open positions and collateral safety.
“While contracts are paused, liquidations will NOT occur. Your collateral is secure and will be recoverable once functions are safely resumed after security checks.” Typus stated and reassured the users against any involuntary losses during the pause. The company has emphasized that it will prevent any forced liquidation until technical systems are fully secure to protect its users from any further risks.
The update has come at a time when concerns within the DeFi sector are increasing day-by-day and pauses or breaches usually leave funds stuck or partially lost. Typus’s proactive approach, which also includes real-time system transparency, aims to set it apart from incidents where slow communication can worsen user anxiety.
Progress Update: Internal Code Fix and Third-Party Audit Pending
The Typus team, in the post, also updated its users and informed them that the developers have completed an internal patch to address the exploit that was found during their post-mortem analysis. However, the protocol will not be redeployed till the time independent security experts have thoroughly reviewed the changes.
“This fix is now pending essential review by independent security experts before any redeployment.” stated the team. This move by the Typus team indicates that the platform is trying to avoid rushed updates that could lead to new vulnerabilities, something that has been highlighted by various DeFi exploits over the past year. The company also let its users know that the timing of redeployment will depend on the review outcomes from these external security partners.
Collaborative Fund Recovery and Tracing Efforts Underway
Along with the technical fixes, Typus Finance is also tracking the affected funds in coordination with blockchain analytics firms, centralized exchanges, and international law enforcement. The update notes that this part of the recovery is ongoing and again depends on the external output.
“Fund tracing efforts continue in coordination with partners, pending updates from law enforcement & exchanges. The asset recovery plan remains under active internal development.” Typus stated. Recovery usually involves quickly identifying exploiter accounts, blacklisting suspicious wallets, and working with exchanges to freeze or intercept laundered funds, all of this is a complex multi-jurisdictional process.
While details remain confidential for reasons, the team has reported the progress and has promised updates as the situation develops.
Background of the Exploit
Typus Finance suffered a security breach on October 15, 2025, which was because of an oracle vulnerability in its TLP (Token Liquidity Provider) contract. The flaw, caused by missing permission checks in the oracle, allowed an attacker to manipulate contract operations and steal around $3.4 million in SUI, USDC, xBTC and suiETH tokens.
The TLP contract calculates prices based on total asset value and open positions. The oracle exploit let the attacker change asset prices or contract states to their advantage, which led to the theft. Typus immediately paused all smart contract operations so that it can protect its user assets and prevent any further loss.
The stolen funds were bridged to Ethereum and converted to DAI, which complicated the recovery. Typus is now working with Sui Foundation, law enforcement, blockchain analytics partners and exchanges to trace and recover the assets. This is the third major exploit in the Sui DeFi ecosystem in 2025, after the Cetus Protocol exploit and Nemo Protocol exploit.
Also Read: Visa to Power DeFi Lending for Financial Institutions
