Hacker "Turned Profitable" with $4.7 Million? Venus Protocol Attack Details Exposed, DeFi Vulnerability Risks Under Scrutiny Again

Gate News: On March 19, BNB Chain’s decentralized lending protocol Venus Protocol recently experienced a rare DeFi attack. Unlike previous “flash arbitrage” hacker operations, this attack lasted nine months and ultimately resulted in an on-chain net loss of about $4.7 million for the attacker, sparking renewed market concern over DeFi security mechanisms.

According to blockchain security firm BlockSec, the attacker continuously accumulated THE tokens via Tornado Cash, and after surpassing Venus-related supply limits, manipulated collateral asset prices to borrow nearly $15 million in crypto assets. However, during subsequent liquidations, due to insufficient liquidity, a large amount of collateral was sold off, leaving only about $5.2 million in assets, resulting in a significant loss compared to the approximately $9.92 million cost.

Although on-chain data indicates the attack failed, industry insiders suggest that the attacker may have hedged risks or realized gains through off-chain channels. At the same time, the incident also impacted the protocol itself. Triggered by liquidation mechanisms, Venus Protocol incurred about $2.1 million in bad debt, exposing potential flaws in its risk control and liquidity management.

Notably, Allez Labs revealed that this attack vector had been flagged in a 2023 audit but was not prioritized for fixing due to being assessed as having “limited impact.” This detail highlights the gap between DeFi security audits and actual risks.

As a key lending infrastructure on BNB Chain, Venus Protocol has historically faced multiple black swan events, including oracle manipulation, liquidation cascades, and cross-chain bridge security breaches. Although this attack did not profit the hacker, it further heightened market awareness of systemic risks in DeFi.