Venus Protocol lost around $2 million due to a hacking exploit involving THE token price manipulation on March 15.
Venus Protocol, a lending platform on the BNB Chain, fell victim to a hacking incident on March 15, which resulted in a loss of approximately $2 million. The attacker manipulated the price of THE token from the DeFi project Thena, exploiting its low liquidity.
Venus Protocol's risk manager stated, "We will continue to provide updates as our investigation progresses."
— Venus Protocol (@VenusProtocol)
The hacker executed a classic price manipulation strategy using an oracle, depositing THE as collateral to borrow assets, then purchasing more THE with the borrowed funds, thereby inflating the token's price. This scheme was made possible after THE was added to Venus's collateral pool.
Overview of the Attack
On-chain analyst Weilin Li was among the first to report the incident, noting that the hacker artificially raised the price of THE from $0.27 to nearly $5. He likened the event to the 2022 Mango Markets hack.
To bypass deposit limits, the hacker employed a donation attack, transferring tokens directly into the vTHE smart contract. This tactic inflated the platform's exchange rate, allowing the attacker to exceed the set limit.
After the initial borrowing, the oracle updated THE's price to $0.50, which lagged behind market values but was nearly double the original price. The attacker attempted to continue their strategy but faced selling pressure that caused the health factor to drop, leading to liquidation.
Despite nominal collateral reaching $30 million, the lack of market depth resulted in THE's price crashing to $0.24 following liquidation.
Outcome for the Hacker
Li indicated that the hacker likely ended up with minimal gains or a loss. It is speculated that they may have hedged their position through perpetual futures elsewhere. Analyst EmberCN estimated that Venus's unrecoverable debt stands at $2.15 million, including loans of 1.18 million CAKE and 1.84 million THE. The hacker's initial capital of 7,400 ETH was traced back to the mixer Tornado Cash.
EmberCN noted, "The hacker borrowed 9.92 million USDT to create chaos, but the assets withdrawn from Venus were only worth $5.07 million."
This incident follows a similar oracle manipulation attack in March 2025, in which Venus lost over $716,000.
