Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
The decentralized lending protocol Venus Protocol, operating on the BNB Chain, experienced an attack related to the exceeding of the token supply limit for THE from the Thena project. Consequently, the platform suspended operations on several markets. The preliminary damage is estimated to exceed $2 million, according to project representatives.
Due to a high concentration of liquidity, the markets for BCH, LTC, UNI, AAVE, FIL, and TWT tokens were also halted. The remaining markets on Venus continue to operate as usual, the developers clarified.
Related Posts
Security experts reported that the attacker had been preparing for the assault for several months. Since June 2025, an unknown individual gradually accumulated THE tokens, ultimately concentrating around 84% of the supply limit—14.5 million tokens.
Instead of utilizing the standard deposit mechanism, the hacker sent tokens directly to the protocol, circumventing the usual checks. This enabled them to significantly exceed the established limit. As a result, their address held 53.2 million THE—approximately 3.5 times the allowable amount.
On the day of the attack, Sunday, 12.2 million THE were deposited into the protocol, which corresponded to about 84% of the set limit. Within an hour and a half, just before the liquidation of the position, the volume reached 53.2 million tokens—around 367% of the limit.
By accumulating a large collateral, the attacker took advantage of the market’s low liquidity and repeatedly executed the same cycle of operations. Initially, they deposited THE tokens, then borrowed other assets, purchased additional THE, awaited the oracle data update, and repeated the process.
As a result, the price of THE surged from $0.27 to $0.53. The nominal collateral volume for the transaction reached approximately $30 million; however, there was insufficient liquidity to sell such an amount. Following the forced liquidation, the token price dropped to $0.24.
At the peak of the attack, the hacker possessed 6.67 million CAKE, 2801 BNB, 1970 WBNB, 1.58 million USDC, and 20 BTCB.
According to on-chain analyst Weilin Li, due to the subsequent decline in the token’s price, the attacker likely did not realize significant profits and may have even incurred losses within the protocol. The expert suggested that the assailant might have hedged their position through perpetual futures on external platforms and profited from those trades.
A few days prior, another attacker withdrew over $4 million from a gaming blockchain platform but lost nearly all the funds due to unsuccessful trading in Ethereum.
