DeFi Platform Venus Protocol Hit by $3.7 Million Flash Loan Hack

On March 15, attackers targeted Venus Protocol, a BNB Chain lending platform, with a suspected flash loan exploit. This action resulted in the theft of an estimated $3.7 million in digital assets.

The breach marks the second major security lapse for the protocol in less than a year, further bruising the reputation of a platform that once sat at the pinnacle of decentralized finance (DeFi).

Venus Confirms ‘Unusual Activity’ on its Platform

Security researchers analyzing on-chain data identified a specific attacker address, 0x1a35…6231, that orchestrated the exploit. The attacker leveraged a massive position in THE, the native token of the Thena exchange, to systematically siphon liquidity from the protocol.

By using THE as collateral, the exploiter successfully withdrew approximately 20 Bitcoin (BTCB), 1.5 million CAKE, and 200 BNB.

Indeed, DeFi users typically use flash loans to borrow millions of dollars without providing upfront collateral. This controversial yet popular tool requires the borrower to repay the entire debt within a single transaction block.

While developers designed these loans for liquidity efficiency, hackers frequently weaponize them to manipulate thin liquidity pools or oracle prices.

In this instance, the attacker appeared to exploit THE’s valuation to borrow higher-quality assets that the protocol may now struggle to recover.

Venus confirmed the “unusual activity” in a statement on X (formerly Twitter). It noted that its investigation is currently narrowed to the THE and CAKE markets.

“We will share updates as our investigation progresses. We appreciate your patience and support,” it added.

The incident is a stark reminder of the “collateral contagion” risks inherent in permissionless lending. Venus, which launched in 2020 and expanded to networks like Arbitrum and Ethereum, has seen its Total Value Locked (TVL) plummet from a peak of $7 billion to approximately $1.47 billion.

This decline follows a string of market downturns and a $13 million phishing attack last year.

With hackers already draining more than $400 million from crypto protocols in 2026, the Venus exploit underscores a systemic challenge for the broader ecosystem to secure its core infrastructure.