DeFi project Titano Finance on BSC lost $1.9 million in a hack

On February 14, PeckShield researchers detected an unauthorised withdrawal of 4,828 BNB (roughly $1.9 million) from the Titano Finance DeFi protocol on the Binance Smart Chain (BSC).

In the face of the project’s silence, PeckShield experts, as well as some other комментаторы suspected the deployment of a rugpull scheme.

#rugpulls PeckShield has detected @TitanoFinance is rugged: the owner sets the PrizeStrategy contract, which then drains about 4,828 BNB (~$1.9m)! The rugged funds were initially held in this wallet 0xad9217e427ed9df8a89e582601a8614fd4f74563 and then split into 24 addresses. pic.twitter.com/vrGbLLspGo

— PeckShieldAlert (@PeckShieldAlert) February 14, 2022

However most users did not share their conclusions. They noted that all Titano Finance smart contracts are still functioning. The compromised service was Titano PLAY for staking with lottery-like features — weekly among its users a prize pool is awarded, depending on the number of participants.

Minutes after the initial PeckShield report, Titano Finance representatives confirmed the PLAY contract was hacked.

Hello Titans,

Titano PLAY was hacked today. Titano, DID NOT mint any tokens. The PLAY contract was compromised, by a malicious hacker who created more Titano Tickets.

Anyone involved in Titano PLAY will have their tokens fully returned.
https://t.co/sfrdi0ZcOq

— Titano (@TitanoFinance) February 14, 2022

They called the incident disconcerting, as the protocol’s code had passed ‘all security checks’. According to the pinned tweet, the audit in November 2021 was conducted by Certik.

The team suspended the PLAY service indefinitely pending remediation of all vulnerabilities. The project promised full restitution of lost funds to affected users.

«First, we know who you are and where you are, and we will relentlessly pursue. You have 24 hours to return the stolen funds without penalties. If this does not happen, the deal is off».

The project cited the broad community, which numbers 42,000 users, and support for the entire DeFi sector.

«Do the right thing and return the money, otherwise you will never sleep easy», — said the Titano Finance team.

The protocol’s native TITANO token tumbled from $0.165 to $0.033 within an hour — roughly an 80% drop. At the time of writing, the asset had retraced much of the fall and was trading around $0.12.  

In January, hackers drained digital assets worth about $80 million from the Qubit Finance lending platform on BSC.

Following the incident, the development team behind the DeFi protocols Bunny Finance announced the transfer of governance of the DAO projects DAO.