Venus’ XVS cryptocurrency declines by 9% following exploit that results in protocol’s bad debt.

The exploit that took place on March 16 did not seem to affect XVS prices until it was revealed that significant holders were transferring large sums to exchanges.

(Yashowardhan Singh/Unsplash/Modified by CoinDesk)

What to know:

• The Venus protocol was compromised on March 16, leading to $2.15 million in unrecoverable debt and a 9% decline in the price of its governance token XVS.
• The attacker influenced the THE token market, borrowed assets, and liquidated THE, resulting in a 17% decrease in price and projected profits between $3.7 million and $5.8 million.
• In response, Venus suspended THE borrows, modified collateral valuations, and is now evaluating how to address the loss through its risk fund.

The governance token XVS of Venus, a money market on the BNB Chain with over $1.4 billion in total value locked, has seen a decline exceeding 9% within 24 hours following an exploit that resulted in $2.15 million in unrecoverable debt.

This decline occurred during a widespread sell-off of risk assets, with the broader CoinDesk 20 (CD20) index dropping 4.6% in the same timeframe.

The exploit, which transpired on March 16, initially did not seem to affect XVS prices until it became apparent that key holders, including wallets associated with Justin Sun, were transferring significant amounts to exchanges.

According to Venus, the exploit within its Thena market resulted in approximately $2.15 million in bad debt, representing loans that the system can no longer reclaim.

The attacker reportedly spent around nine months building a significant position in Thena’s THE token. This accumulation, as noted by PeckShield, was financed with 7,400 ETH withdrawn from the mixing protocol Tornado Cash.

The attacker subsequently donated over 36 million THE directly to the vTHE contract, bypassing the usual cap checks and increasing the market’s exchange rate by roughly 3.8 times. Venus stated that the vulnerability in the code allowing the attacker to avoid these checks is being addressed.

With the inflated paper value, the attacker used THE as collateral, borrowed additional assets, and purchased more THE in a low liquidity environment, as explained by Venus.

This buying activity helped elevate THE from approximately $0.26 to nearly $0.56. Venus clarified that this was not a flash-loan attack, as its oracles continued to function, and Venus Flux remained unaffected.

When the attacker eventually sold THE, the price fell more than 17% in under a day, leading to liquidations. Analysis estimates the value taken before liquidations at about $3.7 million to $5.8 million, with assets that included tokenized bitcoin, BNB, and stablecoins being withdrawn.

The impact was primarily confined to the THE token and, to a lesser degree, CAKE. Venus also indicated that no user funds were lost outside the affected pools.

In response to the incident, the protocol suspended THE borrows and withdrawals, reduced THE’s collateral value to zero, and tightened regulations on other identified at-risk markets. At-risk markets include those for BCH$457.10, LTC$55.36, aave AAVE$114.90, among others.

The address used in the attack had previously been flagged by the community prior to the incident. Venus did not intervene as “no rules had been violated, and no exploit had taken place,” it stated.

“Venus is a decentralized protocol. As a permissionless protocol, we cannot and should not freeze or blacklist addresses based on suspicion alone,” the protocol communicated on social media. “This is a tension inherent to DeFi, and one we take seriously.”

Governance is anticipated to determine how to address the loss through Venus’s risk fund.