The decentralized lending platform Venus Protocol on BNB Chain suffered a sophisticated exploit resulting in losses exceeding $3.7 million. The attack, which unfolded on March 15, 2026, involved the manipulation of the Thena (THE) token's price and supply caps within the protocol's Core Pool.
According to on-chain data analyzed by Wu Blockchain, the attacker, using address 0x1a35…6231, meticulously prepared for the exploit over nine months starting in June 2025, accumulating roughly 84% of THE's supply cap (14.5 million tokens). The actual attack bypassed normal deposit mechanisms by directly transferring THE tokens to the protocol's contract, artificially inflating the collateral position to 53.2 million THE—nearly 3.7 times the allowed limit.
Using this inflated collateral, the attacker executed a recursive borrowing strategy: they borrowed assets, used the funds to buy more THE, waited for the protocol's time-weighted average price (TWAP) oracle to update and reflect the higher price, and then repeated the cycle. This manipulation pushed THE's price from approximately $0.263 to nearly $0.563, significantly overvaluing the collateral within the system.
Against this inflated collateral, the attacker borrowed substantial assets, including around 20 BTC (wrapped as BTCB), 1.5 million CAKE tokens, nearly 200 BNB, and 1.58 million USDC, totaling over $3.7 million.
The scheme eventually unraveled when the attacker's account health factor neared liquidation territory. A wave of forced liquidations flooded the market with THE tokens, causing its price to collapse to around $0.22-$0.24. This volatility created a rare trading opportunity; trader and researcher Weilin (William) Li capitalized on the collapse by opening a short position during the final liquidation stage, securing a profit of roughly $15,000.
In response, the Venus Protocol team has implemented precautionary measures, temporarily pausing borrowing and withdrawals for THE and several other markets showing high liquidity concentration (BCH, LTC, UNI, AAVE, FIL, TWT). All other markets remain operational while the investigation continues, with a detailed report promised upon completion of the analysis.
