Venus Protocol Suffers Supply Cap Attack, Loses $3.7 Million

Decentralized lending platform Venus Protocol announced on Sunday that abnormal trading activity was detected in the core pool for Thena (THE) tokens. According to the latest investigation by Venus’s risk management partner Allez Labs, this incident was a carefully planned supply cap manipulation attack, taking about nine months from planning to execution, resulting in a loss of over $3.7 million.

Full Attack Process Breakdown: Four Carefully Planned Stages

Allez Labs’s investigation revealed the complete operation logic of the attack, divided into four key stages:

Stage One: Slow accumulation of tokens over 9 months. Starting in June 2025, the attacker gradually accumulated THE tokens, eventually holding 84% of the supply cap, about 14.5 million tokens. This slow strategy avoided triggering platform risk alerts.

Stage Two: Direct transfer bypasses supply cap. The attacker did not use normal deposit procedures but transferred tokens directly into the protocol contract, completely circumventing the supply cap mechanism, ultimately establishing a position of 53.2 million THE tokens, 3.67 times the supply cap.

Stage Three: Manipulation of TWAP oracle. Exploiting the structural weakness of THE’s low on-chain liquidity, the attacker recursively manipulated the TWAP (Time-Weighted Average Price) oracle, raising THE’s price from about $0.27 to approximately $0.53.

Stage Four: Inflated collateral to borrow assets on a large scale. Under artificially inflated collateral valuation, the attacker borrowed various high-liquidity assets using 53.2 million THE as collateral.

Details of Stolen Assets and Platform Emergency Response Measures

Assets borrowed at peak:

• 6,670,000 CAKE (PancakeSwap native token)
• 2,801 BNB (BNB Chain native token)
• 1,970 WBNB
• 1,580,000 USDC
• 20 BTCB (tokenized Bitcoin)

Venus Protocol immediately paused all lending and withdrawal activities for THE tokens, and as a precaution, temporarily suspended lending and withdrawal functions in highly concentrated on-chain liquidity markets (including BCH, LTC, UNI, AAVE, FIL, and TWT). Other Venus markets remain operational.

Deep Insights into Security Risks: Systemic Vulnerabilities of Low-Liquidity Tokens

This attack on Venus Protocol exposes several systemic risks in DeFi lending protocols: TWAP oracles for low-liquidity tokens are highly susceptible to price manipulation through small-scale operations; supply cap mechanisms can be bypassed if direct contract transfers are not prevented; and the nine-month slow accumulation strategy reveals potential blind spots in long-term position monitoring.

Frequently Asked Questions

Q: What is the “Supply Cap Attack” on Venus Protocol?
The supply cap is a security mechanism designed to limit the maximum amount of a single asset that can be used as collateral. The attacker bypassed this by transferring tokens directly into the contract, reaching 3.67 times the supply cap, and then manipulated the oracle to inflate collateral valuation, borrowing more assets than the approved credit limit.

Q: How was the attack planned for such a long time without detection?
The attacker used a “Low and Slow” accumulation strategy over nine months, keeping holdings below alert thresholds until reaching 84% of the supply cap before executing the attack. This method is a common way to bypass threshold-based monitoring, highlighting the need for more sophisticated long-term behavior surveillance.

Q: What emergency measures has Venus Protocol taken?
Venus Protocol immediately suspended all lending and withdrawal functions for THE tokens, and proactively paused related functions in highly concentrated liquidity markets such as BCH, LTC, UNI, AAVE, FIL, and TWT. Other markets continue normal operation. Allez Labs and security partners are ongoing investigations and updates.