What happened
On March 16, 2026, Venus Protocol on BSC suffered a $2.18M bad debt incident when an attacker exploited a supply cap enforcement gap to bypass the 14.5M THE token limit, accumulating a massive uncapped position over 9 months, then manipulating THE's price from $0.27 to $0.53 through recursive borrowing loops and low DEX liquidity exploitation, before liquidation left $2.18M in unrecoverable debt.
The attacker executed a sophisticated 9-month operation beginning with 7,400 ETH from Tornado Cash, which was deposited into Aave as collateral to borrow $9.92M in stablecoins. The core vulnerability was a supply cap enforcement gap in Venus' legacy code that allowed direct token transfers to the protocol contract, bypassing normal deposit flows and the 14.5M THE supply cap. The attacker slowly accumulated THE tokens and directly transferred them to the vTHE market contract, building a dominant uncapped position. Once established, the attacker executed a recursive attack loop: borrowing assets (CAKE, BNB, BTC), swapping them for THE to pump its price on low-liquidity DEXs, then directly transferring more THE into the vTHE market to inflate the exchange rate. Each iteration increased the collateral value beyond the borrowed amount, generating excess borrowing power to sustain the loop. This manipulation drove THE's price from ~$0.27 to ~$0.53, which the TWAP oracle reflected as designed. The attacker also likely profited from CEX long positions opened before the pump and short positions before dumping THE. When THE crashed after the dump, cascading liquidations occurred on Venus, leaving $2.18M in bad debt ($1.18M CAKE + $1.84M THE) that collateral could not cover.
Blockchain Data Reference
Attacker Wallets:
Protocol details
Security review history
- CertiK View report
Evidence
Proof of concept
1 availableSources
- report @VenusProtocol incident report x.com
- report @lookonchain incident report x.com
- report Post-mortem rekt.news
- report @hklst4r incident report x.com
- report Venus THE Market Incident Post-Mortem community.venus.io
- transaction Transaction bscscan.com
- analysis DeFiLlama defillama.com
- analysis BlockSec: Venus Thena donation attack blocksec.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
