Ploutos Money
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5BTZ3e…EGoTSummary
Ploutos Money was a multi-chain DeFi lending and leveraged farming protocol, forked from Aave v3.0.2, that operated across Ethereum, Arbitrum, Hemi, Hyperliquid, Avalanche, Polygon, Base, Plasma, and Katana. On February 26, 2026, the protocol lost approximately $388,000 (187.36 ETH) after its USDC price oracle was misconfigured to reference Chainlink's BTC/USD feed instead of the correct USDC/USD feed. Immediately following the exploit, the team deleted its website, GitHub repository, and all social media accounts without issuing any warning or post-mortem, prompting on-chain security firms CertiK and BlockSec to conclude that the incident was an inside job rather than an external attack.
Connected Entities
1 entitiesTimeline(10 events)
2025
Ploutos Money launches as a multi-chain Aave v3.0.2 fork across Plasma, Arbitrum, Polygon, Base, and Katana, advertising leveraged lending and farming features.
February 2026
Arbitrum integration with Ploutos announced, expanding the protocol's multi-chain footprint per TradingView/Coindar announcement.
26 February 2026
At approximately 05:00 UTC, the USDC oracle on Ploutos Money is misconfigured to reference Chainlink's BTC/USD feed instead of the USDC/USD feed (block 24538896). One block later (block 24538897), an attacker borrows 187.36 ETH using only 8 USDC as collateral. $388,000 is drained across Hemi, Ethereum, Arbitrum, Hyperliquid, and Avalanche deployments.
26 February 2026
Immediately following the exploit, the Ploutos Money website, GitHub repository, X account, and all social media are deleted. No incident notice or post-mortem is issued.
26 February 2026
CertiK and BlockSec flag the oracle misconfiguration and subsequent exploit in real time. Both firms document that the protocol's website and social accounts have been deleted.
27 February 2026
Hemi Network issues an official statement confirming the exploit, stating its core protocol is unaffected, warning users against following unverified Telegram recovery instructions, and publishing 12 contract addresses requiring permission revocation.
27 February 2026
Pseudonymous investigator Tanuki42 links the Ploutos exploiter wallet to at least four additional hacks, including two Moonwell incidents totaling approximately $1.8 million in bad debt.
March 2026
BlockSec includes the Ploutos Money exploit in its weekly Web3 security incident roundup for February 23 to March 1, 2026, providing detailed block-level technical analysis.
13 March 2026
On-chain trackers observe 182 ETH moving to wallet 0x640fb638efcc086f5e95536678087e14a2e96ab, which then swaps holdings to stablecoins and disperses to nine or more additional wallets.
21 March 2026
A victim account published on Medium documents a $300,000 individual loss and partial recovery of approximately $210,000 via blockchain forensics firm AYRLP, with FBI IC3 and FTC complaints filed.
Decision Log
- hash: 2nSdAVo71GX49LAhVypGerE5mGd86TWuvZMFYVzTqQhg
This investigation is cryptographically anchored to the Solana blockchain (1 event). 9 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:13 AM
last updated: 8/30/2026, 3:54:57 AM
avoid.net — verified advice for a post-truth world