Ploutos Money, a low-profile DeFi lending platform offering eye-catching yields on assets like HYPE, got wrecked on February 26 in what looks suspiciously like an inside job.
On-chain security and auditing platforms like CertiK and BlockSec highlight that the protocol lost 187.36 ETH, roughly $388,000, after someone misconfigured its price oracle. Instead of pulling USDC prices from the proper Chainlink feed, it wrongly referenced BTC/USD.
That glitch let an attacker dump just 8-9 USDC as collateral and walk away with nearly 188 ETH in a single swipe. The bad config transaction hit one block before the exploit, suggesting the drainer was watching live, or it was indeed an insider job.
Interestingly, the protocol’s website was scrubbed minutes after the exploit, followed by its X account. This wiped-off online presence, consisting of no warning or no post-mortem, has raised speculations that it was more like a planned exit than a random external hack.
This is a developing story. More information will be added as the event unfolds.
