Overview
- Venus froze six high‑risk markets and paused all THE borrowing and withdrawals as its investigation continues.
- The exploiter sent THE directly to the vTHE contract to inflate collateral, then looped borrows as the TWAP oracle lagged.
- On‑chain data indicates about 20 BTC, 6.67 million CAKE, 2,801 BNB, and 1.58 million USDC were borrowed before liquidations.
- Investigators report the attacker’s wallet was funded with 7,400 ETH via Tornado Cash, and the on‑chain outcome may have yielded little or no profit.
- Venus says it is tightening collateral controls and reviewing oracle design after audits had previously flagged the donation‑attack vector.