Venus Protocol Core Pool (THE market) hack — March 2026

The THE (Thena) market in Venus Protocol's core pool on BNB Chain was attacked on 15 March 2026 at about 11:55 UTC. Venus's post-mortem describes a donation attack: because the vToken contract's getCashPrior function reads the underlying token balance directly rather than internally tracked supply, and supply caps are enforced only in mintAllowed, an attacker who transfers THE directly to the vTHE contract inflates the vTHE/THE exchange rate without passing the cap check. The attacker, who had accumulated roughly 84% of the 14.5 million THE supply cap over the preceding nine months, repeatedly borrowed against the inflated collateral, bought more THE on the market and donated it back. The exchange rate rose 3.81x (10,086,934,836 to 38,420,106,438) and THE supplied reached 53,230,145, 367% of the cap. THE's thin liquidity allowed its price to be driven from about $0.26 toward $4 on the Binance Oracle before collapsing to roughly $0.22.

The published figures measure different things. Venus's own accounting, repeated in its governance patch proposal, is approximately $2.15 million of bad debt left on the protocol, held in about 1.18 million CAKE and 1.84 million THE; Halborn gives approximately $2.18 million for the same item. Reporting by Wu Blockchain puts the assets extracted at about $3.7 million. BlockSec calculates that the attacker borrowed roughly $14.9 million at peak, that 254 liquidation callers processed 8,048 transactions against the position, and that the attack was unprofitable on-chain — the attacker invested $9.92 million and retained about $5.2 million.

Venus froze THE borrowing and withdrawals, applied a zero collateral factor to eight further markets as a precaution, and advanced VIPs 600, 601 and 602 to replace balanceOf-based cash reporting with an internalCash variable tracked by the protocol's own _doTransferIn, _doTransferOut and badDebtRecovered functions, covering BNB Chain plus Arbitrum One, Base, Ethereum, opBNB, OP Mainnet, Unichain and zkSync. Venus states the vulnerability class is a known weakness in Compound forks and had been identified in a prior Code4rena audit of Venus; Halborn reports the protocol had treated donations as an intentional feature and declined to fix it. No reimbursement has been announced.