THE (THE)

Another lending and borrowing DeFi protocol got hit by an attack or manipulation again!!! This time it’s @VenusProtocol, the old DeFi from the era when I first started playing DeFi on BSC!!! So what’s up? Let me explain based on the post‑mortem results from Allez Lab.

1️⃣ Intro Allez Labs is a research laboratory and consultancy specializing in risk management, strategy, data analysis, and the development of open‑source tools for the Decentralized Finance (DeFi) ecosystem. On March 15, 2026, Venus Protocol, one of the leading lending platforms in the BNB Chain ecosystem, experienced a security incident that generated bad debt of approximately $2.15 million. The incident was completely isolated to the THE and CAKE markets, without affecting the protocol’s smart contracts. The in‑depth analysis published by Allez Labs provides a comprehensive explanation of the preparation, attack mechanism, root cause, and remediation steps taken.

2️⃣ Attack Preparation The attack was meticulously planned over nine months. The attacker accumulated THE tokens across multiple wallets, eventually controlling 84% of the market’s supply cap, i.e., 14.5 million tokens. The operational funding came from 7,447 ETH withdrawn from Tornado Cash in 77 separate transactions. Those funds were then supplied to Aave, lent out as stablecoins, and used to purchase additional THE.

3️⃣ Exploitation Mechanism The attack started precisely at 11:55 UTC with the deployment of an atomic attack contract. Six wallets directly donated about 36 million THE tokens to the vTHE contract. This method bypassed the supply‑cap check because the restriction only applies to the minting pathway, not direct transfers. As a result, the vTHE exchange rate surged to 3.81×. Collateral originally valued at $3.3 million rose to over $12 million, increasing borrowing power from $0.47 million to $5.08 million. With the inflated position, the attacker then borrowed assets worth roughly $14.9 million, including 6.67 million CAKE, 2,801 BNB, 1,972 WBNB, 1.58 million USDC, and 20 BTCB. Subsequently, they executed a recursive borrow‑swap‑donate loop that pushed THE supply to 53.2 million tokens (3.67× the supply cap) while pumping THE’s price from around $0.26 to $0.51. Oracle Resilient (RedStone s

4️⃣ Root Cause of the Vulnerability The core issue lies in the “donation” mechanism within Venus’s architecture, which is a fork of Compound. The getCashPrior() function reads token balances directly, allowing donations to inflate the exchange rate without triggering the supply‑cap check. This weakness was actually identified in the 2023 Code4rena audit, but was deemed to have no significant negative impact at the time. The combination of extremely thin THE liquidity, extreme ownership concentration, and reliance on an oracle created the perfect conditions for this attack.

5️⃣ Financial Impact When the health factor approached the critical threshold of 1, THE’s price instantly collapsed to around $0.22. Mass liquidations and panic selling by holders resulted in a final bad debt of $2.15 million (comprising $1.18 million CAKE and $1.84 million THE). From an on‑chain perspective, the attack does not appear to have been profitable for the attacker; any off‑chain gains remain under investigation.

6️⃣ Remediation and Improvement Steps Venus Protocol acted quickly and decisively. The THE, CAKE and other risk‑related assets (BCH, LTC, UNI, AAVE, POL, FIL, TWT, and lisUSD) markets were immediately paused. The attacker’s address has been traced and is being monitored together with forensic partners. Strengthening of supply‑cap enforcement, collateral parameter adjustments, and a comprehensive protocol audit are currently underway.

7️⃣ Valuable Lessons for the DeFi Ecosystem The incident reminds us that in an adversarial DeFi environment, any mechanism that can bypass security parameters, no matter how small, should be treated as a potential attack vector. Audit findings must not be taken lightly, and liquidity risk management and wallet concentration need to be significantly improved. The full post‑mortem report can be read on the Venus Protocol community forum. Although the loss is relatively limited compared to the protocol’s total value locked, this case further strengthens the overall resilience of the DeFi ecosystem. https://t.co/QT5IRh5MUJ