Venus Protocol Flash Loan Attack Causes $3.7M Loss on BNB Chain

TLDR:

• Venus Protocol lost $3.7M in a flash loan attack using THE token as collateral.
• THE token price surged to $0.563 before collapsing to $0.22 during liquidation events.
• Six Venus markets including BCH and LTC were temporarily frozen after the exploit.
• Borrowing and withdrawals for THE token paused while investigation continues.

Venus Protocol flash loan attack on BNB Chain caused over $3.7 million in losses. THE token was exploited to manipulate collateral, enabling the attacker to borrow high-value assets before the market collapsed.

Exploit Mechanics and Borrowing Strategy

The Venus Protocol flash loan attack targeted the Core Pool on BNB Chain, using THE token as collateral. The attacker accumulated approximately 84% of THE supply over nine months to prepare for the exploit.

Instead of following the standard deposit process, the attacker directly transferred tokens to the vTHE contract. This allowed collateral positions far above the supply cap, reaching 53.2 million THE tokens, nearly 3.7 times the protocol’s limit.

Using this inflated collateral, the attacker borrowed about 20 BTC, 1.5 million CAKE, 200 BNB, and 1.58 million USDC. 

The strategy repeated in a loop: deposit THE, borrow assets, purchase more THE, and wait for the TWAP oracle to adjust, inflating collateral value.

The manipulation caused THE’s price to spike from $0.263 to $0.563 before falling to $0.22 as liquidations occurred. This pattern mirrored prior DeFi exploits involving low-liquidity tokens and automated liquidations.

Venus Protocol Response and Market Measures

Following the attack, Venus froze six high-risk markets, including BCH, LTC, UNI, AAVE, FIL, and TWT. Borrowing and withdrawals of THE tokens were temporarily paused while all other markets remained operational.

Investigations suggest the attacker may have used Tornado Cash to fund operations. Venus has since tightened collateral rules and plans to review oracle mechanisms to prevent similar attacks in the future.

The estimated bad debt ranges from $1.7 million to $2.15 million, mainly from the CAKE market. The protocol confirmed the unusual activity was confined to the THE and CAKE markets and did not affect the broader ecosystem.

Security analysts continue monitoring Venus to assess the handling of low-liquidity tokens. Investors are advised to exercise caution when lending or borrowing such tokens, ensuring robust protocols are in place to minimize risk.

The post Venus Protocol Flash Loan Attack Causes $3.7M Loss on BNB Chain appeared first on Blockonomi.