Venus Protocol: THE Market Incident Stemmed from Supply Cap Vulnerability, Not a Flash Loan Attack

Odaily News Venus Protocol has issued a statement regarding the THE market incident, clarifying that it was not a flash loan attack but rather the result of an attacker exploiting a supply cap execution vulnerability in the protocol's legacy code. The team stated that the attacker had been accumulating THE tokens over approximately nine months, gradually establishing a dominant supply position on Venus.

The announcement pointed out that the attacker bypassed the normal deposit process by directly transferring THE tokens into the protocol contract, thereby breaking through the 14.5 million THE supply cap limit. They then manipulated DEX prices by taking advantage of the low on-chain liquidity. As the external price was gradually reflected by the TWAP oracle, the attacker cyclically borrowed assets (such as CAKE, BNB, etc.) using the inflated collateral value, bought more THE to push the price higher, and continuously transferred THE into the vTHE market to increase the collateral value. This cycle drove the price from around $0.27 to approximately $0.53, ultimately leaving bad debt in the protocol after the position was liquidated.

Venus stated that it has currently suspended the THE market, reducing its collateral factor to 0 and pausing withdrawals. Additionally, as a precautionary measure, the collateral factors for eight other markets—BCH, LTC, AAVE, POL, FIL, TWT, UNI, and lisUSD—have also been reduced to 0. The team and security partners are continuing their investigation and will release a comprehensive post-mortem analysis report subsequently.