Venus’ XVS token declined more than 9% over the past day after an exploit left the BNB Chain-based lending protocol with approximately $2.15 million in bad debt.
While the incident occurred on March 16, price action remained relatively stable until on-chain analysts identified large holders moving XVS to exchanges, triggering a wave of selling.
The protocol, which holds over $1.4 billion in total value locked, came under pressure alongside a broader market downturn that saw the CoinDesk 20 (CD20) index fall 4.6% over the same period.
According to Venus, the attacker exploited thin liquidity in the THE token market. By accumulating THE and posting it as collateral, the attacker borrowed other assets and recycled liquidity back into THE, driving its price from roughly $0.26 to nearly $0.56.
Venus said the exploit did not involve flash loans, noting that its oracle systems functioned as intended and that Venus Flux was not affected.
The trade unwound when the attacker began selling THE, sending the token down more than 17% within 24 hours and triggering liquidations. Estimates suggest between $3.7 million and $5.8 million was extracted prior to those liquidations, including tokenized bitcoin, BNB, and stablecoins.
The protocol said the impact was largely contained to THE and, to a lesser extent, CAKE markets, with no user losses reported outside the affected pools.
In response, Venus paused borrowing and withdrawals for THE, reduced its collateral value to zero, and tightened risk parameters across other markets deemed vulnerable, including BCH, LTC, and AAVE.
The wallet linked to the exploit had previously been flagged by the community. However, Venus said it did not intervene, as no protocol rules had been violated at the time.
“Venus is a permissionless protocol, and freezing or blacklisting addresses based solely on suspicion is not appropriate,” the team said, underscoring the inherent trade-offs of decentralized finance.
A governance decision is expected to outline how the protocol will absorb the losses, likely through its risk fund.
