Venus Protocol Detects $3.7M Supply Cap Attack on THE Pool

TheNewsCrypto發佈於 2026-03-16更新於 2026-03-16

文章摘要

Venus Protocol detected a suspicious trading activity in its THE token liquidity pool on March 15. The incident, identified as a supply cap attack, occurred in two phases. First, the attacker accumulated approximately 84% of the total Thena token market capitalization. Then, they used these holdings as collateral to borrow other assets, including 6.67 million CAKE tokens, 1.58 million USDC, 2,801 BNB, and 20 Bitcoin, resulting in over $3.7 million in losses. Only the CAKE and THE pools were directly affected. In response, Venus halted all THE borrows and withdrawals, as well as those for other low-liquidity tokens. This attack represents a notable protocol-level exploit in DeFi for 2024.

On March 15, Venus Protocol revealed that it has found some suspicious trading activity in its liquidity pool for the Thena (THE) token. For clarification, Venus operates as a lending and borrowing platform, and THE is the native token of the Thena DeFi platform.

Venus has appointed Allez Labs as its risk manager, which stated that the incident seems to be a supply cap attack and it unravelled in two phases. The first phase shows that the attacker gradually collected around 84% of the overall Thena token market capitalisation.

The second phase included the attacker using those holdings as collateral to borrow other assets from the platform. The borrowed assets comprised 6.67 million CAKE tokens, 1.58 million USDC, 2,801 BNB, and 20 Bitcoin, as reported by Allez Labs.

The overall value lost in the attack surpassed $3.7 million, revealed by Wu Blockchain. Only the CAKE and THE pools were directly impacted by the exploit.

The Notable Attack

Venus Protocol replied by halting all THE borrows and withdrawals quickly. The team mentioned in a statement that this will stay in effect until the investigation is taken to end. As an extra precaution, Allez Labs mentioned Venus also shut withdrawals and borrowing for various other low-liquidity tokens on the platform.

The attack is one of the more noteworthy decentralised finance security incidents of this year. The overall losses via crypto hacks slipped to $49 million in February, the lowest monthly figure in around a year, as per the blockchain security company PeckShield.

That slip in hack-associated losses was, although, accompanied by a surge in phishing and social-engineering attacks aiming at individual users.

Nominis, a blockchain intelligence platform, mentioned that a lot of individual attacks in February comprised phishing websites, malicious signature requests, and address poisoning scams made to steal private keys.

The Venus incident shows a different threat category, one aiming protocol-level mechanics instead of individual user credentials.

Highlighted Crypto News Today:

Playnance Partners With KGeN to Expand Web3 Gaming Distribution Network

TagsHackHack AttackVenus

相關問答

QWhat type of attack did Venus Protocol detect on its THE pool?

AVenus Protocol detected a supply cap attack on its THE pool.

QWhat was the total value of assets lost in the attack on Venus Protocol?

AThe total value lost in the attack surpassed $3.7 million.

QWhich two token pools were directly impacted by the exploit?

AOnly the CAKE and THE pools were directly impacted by the exploit.

QWhat immediate action did Venus Protocol take in response to the attack?

AVenus Protocol halted all THE borrows and withdrawals, and also shut withdrawals and borrowing for various other low-liquidity tokens on the platform.

QWhat was the first phase of the attack as described by risk manager Allez Labs?

AIn the first phase, the attacker gradually collected around 84% of the overall Thena token market capitalisation.

你可能也喜歡

比特币提现仍在继续:Coldcard冷钱包8年存储终成空

硬件钱包Coldcard遭黑客攻击,导致大量资金从易受攻击设备中被持续转出。据Galaxy Research数据,截至2026年8月2日,已有4585个地址被盗,损失总额达1367.05 BTC(约合8860万美元),远超7月30日最初报告的594.5 BTC。大部分被盗资金仍停留在攻击者地址。 问题根源并非固件,而是设备生成的种子短语存在漏洞。2021年3月起,因程序员错误集成libNgU库,设备从使用STM32硬件随机数生成器转为使用软件生成器Yasmarang,该生成器由公开可获取的芯片序列号和计时器状态初始化,导致生成的种子短语可在离线状态下被暴力破解。即使固件后续已更新,只要用户未将资金转移至基于新种子短语生成的新地址,旧钱包就始终处于风险中。 受影响的设备包括特定固件版本的Mk2/Mk3、Mk4/Mk5及Q系列。仅当种子短语是通过至少50次独立掷骰子或强唯一性BIP-39密码短语创建时方可幸免。官方建议受影响用户立即在已修复的固件上生成新种子短语并转移资产。 报道提及一位39岁投资者的案例,他因该漏洞损失了2 BTC(约13万美元)。他多年来通过体力劳动积攒比特币,将其视为在制裁和高通胀国家中的财务保障与提前退休的途径。此次事件使他的长期持有策略和“冷存储”信心遭受重击,他因此决定彻底退出加密货币领域。 从历史数据看,随机数生成器缺陷并非首例,类似问题曾导致巨额损失。此次事件警示,即使离线存储也未必绝对安全,其安全性高度依赖于底层硬件和算法的可靠性。

cryptonews.ru1 小時前

比特币提现仍在继续:Coldcard冷钱包8年存储终成空

cryptonews.ru1 小時前

帕克·刘易斯解释为何比特币仍是最佳货币

知名比特币分析师帕克·刘易斯在访谈中批评了某些上市公司以“数字信贷”形式销售永续优先股的营销策略,认为这从根本上扭曲了比特币的本质。他指出,比特币在算法层面不具备法币收益性,承诺定期分红主要依赖牛市吸引新投资者来维持,风险极高。 刘易斯引用数据说明此类衍生品的巨大风险:全球信贷市场规模达300万亿美元,而永续优先股市场仅约1万亿美元,这表明机构有意规避这种无还款期限的资产,将风险转嫁给信息不足的散户。 针对“比特币波动性太大”的常见观点,他认为波动性是这一供应量严格受限的新资产被大规模采用过程中的自然数学结果。新人入场需出更高价从早期持有者手中购买,导致价格剧烈波动。他建议投资者直接持有比特币,这比投资MicroStrategy等公司发行的衍生品更安全。 投资者将焦点从直接持有加密货币转向公司衍生品,会忽视法币急速贬值的真正威胁。刘易斯以自创的“肋眼牛排指数”为例,指出其本地超市一款牛排价格从2020年的19.99美元涨至37.99美元,反映年化约12-13%的真实通胀,远超官方平滑后的CPI数据。 在全球通胀环境下,最明智、保守且安全的策略仍是直接持有比特币并完全掌控私钥。追逐加密货币国库股等公司工具的收益只会叠加隐性系统风险,而理解去中心化货币的本质才能有效保护财富免受宏观经济动荡影响。

cryptonews.ru5 小時前

帕克·刘易斯解释为何比特币仍是最佳货币

cryptonews.ru5 小時前

交易

現貨
活动图片