Venus Protocol, a lending platform on BNB Chain, was exploited for roughly $3.6 million after attackers manipulated the liquidity of the THE token. The attacker accumulated 84% of the token’s circulating supply over months, then used it to inflate collateral value via flash loan cycles. Venus has suspended the THE market and tightened collateral rules for several other assets.
A lending platform on BNB Chain, Venus Protocol, suffered a fresh exploit after attackers manipulated token liquidity. The incident drained roughly $3.6 million and forced the protocol to restrict trading on several assets.
Analysis indicates the operation had been underway for months, with the attacker accumulating roughly 14.5 million THE. This amounted to about 84% of the native token of Thena‘s circulating supply.
The attacker transferred the tokens into Venus Protocol‘s lending system, bypassing the typical deposit flow. This allowed the creation of an artificial position that far exceeded the token’s actual circulating supply.
The strategy relied on the token’s thin on-chain liquidity and repeated deposit-and-borrow cycles. Each cycle pushed the oracle price higher, inflating the collateral value.
The exploit ultimately drained around $3.6 million in various assets. The stolen funds included significant amounts of PancakeSwap, BNB, USD Coin, and Bitcoin BEP2 tokens.
In response, the team behind Venus Protocol suspended the THE market and introduced tighter collateral requirements. The revised framework raises thresholds for tokens considered high risk.
Under the new conditions, collateral tokens must meet stricter standards for market metrics. Six assets were flagged, including Bitcoin Cash [BCH], Litecoin [LTC], Uniswap [UNI], Aave [AAVE], Filecoin [FIL], and Trust Wallet Token [TWT].
This was not the first security incident involving the protocol. Venus Protocol reported losses of roughly $27 million after a phishing attack compromised access in September 2025.
That exploit allowed access to iToken assets such as vUSDC and vETH. Despite the latest incident, the platform’s Total Value Locked remained relatively stable near $1.47 billion.
