Venus Protocol suffered a flash-loan attack netting $3.7M in BTC, CAKE, and BNB via THE collateral manipulation.
Security & Exploits ·
Venus Protocol faced a flash-loan attack in which an address obtained approximately 20 BTC, 1.5 million CAKE, and 200 BNB—totaling over $3.7 million in value. The attacker leveraged a large quantity of THE token as collateral on Venus to borrow CAKE, BTCB, and BNB, exploiting price movements to extract the assets. On-chain records show tens of millions of THE now undergoing liquidation as a result of the incident.
The mechanics involved using THE as collateral to access borrowing capacity, then executing trades or withdrawals that generated the reported losses. Flash loans allow brief, uncollateralized borrowing within a single transaction, and when combined with collateral manipulation, can enable attacks if a protocol's price oracles or liquidation mechanisms are vulnerable to rapid price swings or insufficient safeguards.
What remains unclear is whether the attack exploited a specific vulnerability in Venus's price feed, liquidation logic, or THE's valuation, and whether the protocol has implemented measures to prevent similar incidents. The extent of recovery of stolen assets or potential compensation mechanisms has not been detailed.