Odaily Planet Daily reports that Venus Protocol has issued a statement regarding the THE market event, clarifying that this incident was not a flash loan attack, but rather resulted from an exploit of a supply cap enforcement vulnerability in the protocol’s old code. The team stated that the attacker accumulated THE tokens over approximately nine months, gradually establishing a dominant supply position on Venus.
The announcement states that the attacker bypassed the normal deposit process by directly transferring THE tokens into the protocol contract, thereby exceeding the 14.5 million THE supply cap. Exploiting low on-chain liquidity, the attacker manipulated DEX prices. As the external price was gradually reflected by the TWAP oracle, the attacker borrowed assets (such as CAKE and BNB) using inflated collateral values, then purchased more THE to further drive up the price, continuously transferring THE into the vTHE market to increase collateral value. This cycle pushed the price from approximately $0.27 to around $0.53, ultimately leaving bad debt in the protocol after positions were liquidated.
Venus has paused the THE market, reduced its collateral factor to 0, and suspended withdrawals. As a precautionary measure, the collateral factors for eight other markets—BCH, LTC, AAVE, POL, FIL, TWT, UNI, and lisUSD—have also been reduced to 0. The team and security partners are actively investigating the situation and will release a comprehensive post-incident analysis report shortly.