Venus Protocol Exploit Leaves $2.15M Bad Debt After THE Token Crash

Decentralized lending protocol Venus Protocol on the BNB Chain has identified unusual activity in its $THE liquidity pool, resulting in an estimated $2.15 million in bad debt following a suspected price manipulation exploit on March 15, 2026. The platform’s risk manager, Allez Labs, described the incident as a “supply cap manipulation attack,” with Venus confirming that only the $THE and $CAKE markets appear affected, while emphasizing that all other markets remain operational and unaffected.The incident centered on the low-liquidity $THE token (native to the Thena DeFi project), which the attacker allegedly used as collateral to borrow valuable assets before engineering a sharp price decline that triggered mass liquidations.

Attacker’s Alleged Strategy and On-Chain Flow

Approximately 7,400 ETH was transferred to the attacker’s address through the Tornado Cash privacy mixer. The funds were then used to borrow roughly $9.92 million in stablecoins via Aave, which were distributed across multiple wallets to purchase large volumes of $THE.

The attacker reportedly accumulated significant amounts of $THE over time, at one point controlling as much as 84% of the token’s supply according to some estimates. The token’s price was then allegedly pushed higher on centralized exchanges before more than 36.1 million $THE tokens were deposited as collateral into Venus Protocol.

This allowed the attacker to borrow approximately $5.07 million worth of assets (with some community estimates placing the figure around $3.7 million), including 2,172 BNB, 1.516 million CAKE, and 20 BTC.

Price Crash and Liquidation Cascade

Shortly after, the attacker dumped $THE on CEXs, causing a rapid price crash, $THE surged briefly before dropping more than 17% in the following 24 hours. The collapse triggered cascading liquidations on Venus, with tens of millions of $THE tokens entering liquidation queues.

While most collateral was liquidated, the protocol incurred a shortfall of about 1.18 million CAKE and 1.84 million $THE, equating to roughly $2.15 million in uncovered bad debt. Analysts suggest primary gains for the attacker likely came from leveraged CEX positions during the dump.

The chart shows the extreme volatility during the exploit on March 15, 2026: a sharp pump from around $0.27 to a peak of approximately $0.56, followed by a steep crash to around $0.21 amid cascading liquidations and market reaction. As illustrated in the above price chart, the brief surge allowed inflated collateral valuation on Venus Protocol, while the rapid plunge triggered widespread liquidations and contributed to the $2.15 million bad debt shortfall.

Venus Protocol’s Emergency Response

In official statements on X, Venus Protocol responded with precautionary measures:

Confirmed unusual activity in the $THE pool and initiated an active investigation, noting limited impact to $THE and $CAKE markets.
Paused all $THE borrows and withdrawals immediately to prevent further misuse.
Reduced the Collateral Factor (CF) to zero for seven markets (BCH, LTC, UNI, AAVE, FIL, TWT, and lisUSD) based on risk criteria, including single-user collateral concentration over 60%, low market cap, trading volume, and DEX TVL.

The protocol stressed transparency and committed to sharing a full report upon conclusion of the investigation, with expectations that bad debt will be covered from treasury reserves. This event highlights ongoing DeFi risks when illiquid tokens serve as collateral, particularly with potential TWAP oracle delays or supply cap bypasses. Venus has a history of similar incidents, underscoring the need for enhanced risk controls.

Similar volatility has been seen across the decentralized lending ecosystem. In another recent case, a trader reportedly suffered a $50 million loss in a single DeFi trade on the Aave platform, highlighting the significant risks associated with leveraged positions in DeFi lending markets.