Venus Protocol Exploit Triggers Bad Debt After Token Manipulation

Steady attention without excessive speculation.

Background and Context

The Venus Protocol exploit followed a familiar DeFi attack pattern that combines supply-cap bypass techniques and oracle price manipulation. First, the attacker reportedly received 7,400 ETH through Tornado Cash. Then, the attacker used flash-loan-style funding to push up THE token’s market price on exchanges. After inflating the price, the attacker deposited tens of millions of THE tokens as collateral on Venus.

As a result, the attacker borrowed significant assets including about 20 BTC, 1.5 million CAKE, and 200 BNB. Once the borrowing phase ended, the attacker quickly sold large amounts of THE. Consequently, the token’s price dropped by more than 17 percent within 24 hours. This sharp decline triggered cascading liquidations across Venus markets. Ultimately, the protocol absorbed an estimated $2.15 million to $2.18 million in bad debt, with most losses concentrated in the CAKE market.

Importantly, Venus has experienced similar incidents in the past. In 2021, manipulation involving the XVS token created about $95 million in bad debt. Later, the Terra and LUNA collapse in 2022 caused another $14 million in losses. The platform also faced a BNB Chain bridge-related exploit and a major phishing incident in September 2025. During that phishing attack, a user lost up to $27 million, although the team later recovered most funds. Therefore, the latest Venus Protocol exploit reinforces ongoing concerns about oracle reliability, collateral concentration, and liquidity risks in Compound-fork lending architectures.

Details of the Exploit

On-chain analysts and security firms including Allez Labs, which manages risk for Venus, traced the attacker’s wallet and reconstructed the exploit sequence. The attacker inflated THE’s price through aggressive buying, deposited oversized collateral, borrowed valuable assets, and then dumped the token. Importantly, the attacker did not compromise Venus smart contracts or directly steal user funds from unaffected pools. Instead, the exploit targeted permissionless collateral rules and thin market liquidity.

Large liquidations of THE amplified price pressure and increased protocol losses. Venus confirmed that the impact remained limited to THE and CAKE pools during the initial phase. So far, the team has not reported broader ecosystem contagion.

Venus Protocol’s Response

In response, Venus paused borrowing and withdrawals for THE on March 15. The protocol also reduced collateral factors to zero for several high-concentration markets including BCH, LTC, UNI, AAVE, FIL, TWT, and lisUSD. These measures aim to prevent similar attacks while investigations continue.

However, unlike the 2025 phishing case, this exploit created genuine bad debt. Therefore, governance discussions may focus on compensation mechanisms or tokenomics adjustments. In the meantime, Venus has advised users to monitor their health factors and avoid paused markets.