Overview
- On-chain analysis shows the exploiter sent THE directly to Venus’s vTHE contract to bypass supply caps and, using oracle lag, looped deposits and borrows to inflate collateral.
- The attacker borrowed 6.67 million CAKE, 1.58 million USDC, 2,801 BNB, and 20 Bitcoin before positions were pushed into liquidation as prices whipsawed.
- Venus paused all THE borrowing and withdrawals and froze several higher-risk markets, including BCH, LTC, UNI, AAVE, FIL, and TWT, while the investigation continues.
- Analyst estimates place uncollateralized debt at about $1.7 million to $2.15 million concentrated in THE and CAKE markets, with the protocol confirming the scope of impact.
- Tracing links the attacker’s initial funding to Tornado Cash, and some researchers report the exploiter may have realized little or no net profit due to liquidation dynamics.