Venus Core Pool
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5KDGnA…jBw8Summary
Venus Core Pool is the primary lending market of Venus Protocol, the largest decentralized money market on BNB Chain. The protocol has accumulated over $112 million in cumulative losses across at least five separate security incidents since 2021, including oracle manipulation, a phishing attack draining $27 million from the Core Pool itself in September 2025, and a donation-attack exploit in March 2026 that left $2.15 million in unrecoverable bad debt. A critical vulnerability flagged during a 2023 Code4rena security audit was dismissed by the development team and subsequently exploited twice.
Connected Entities
11 entities · 60 linked investigations- Filecoin→mentioned with→Binance(70%)
- BNB Chain Bridge→mentioned with→Binance(70%)
- Trust Wallet→mentioned with→Binance(70%)
- Venus Core Pool→mentioned with→BNB Chain Bridge(80%)
- Venus Core Pool→mentioned with→Terra/Luna(80%)
- Venus Core Pool→mentioned with→Bitcoin Cash(80%)
- Venus Core Pool→mentioned with→ZKsync(65%)
- Venus Core Pool→mentioned with→Trust Wallet(80%)
- Venus Core Pool→mentioned with→Chainlink(65%)
- Venus Core Pool→mentioned with→Binance(60%)
- + 3 more
Timeline(11 events)
2020
Venus Protocol launched on BNB Chain by the Swipe Wallet development team, forking Compound and MakerDAO
May 2021
XVS oracle manipulation attack; attacker pumps XVS price from ~$70 to ~$140, borrows ~2,000 BTC and ~5,700 ETH; protocol left with $95 million in bad debt
May 2022
Terra/LUNA collapse causes $14 million in bad debt on Venus due to stale Chainlink price feed with hard-coded $0.10 minimum for LUNA
October 2022
BNB Chain bridge exploiter deposits 900,000 BNB as collateral on Venus to borrow $150 million in stablecoins; BNB Chain governance intervenes to prevent destabilizing liquidation
May 2023
Code4rena audit of Venus Isolated Pools documents donation attack vector under finding M-10; Venus development team dismisses it as 'supported behavior with no negative side effects'
February 2025
Venus ZKSync deployment suffers donation-style exploit on wUSDM market; approximately $717,000 in net bad debt incurred; BNB Chain deployment left unpatched
June 2025
Alleged attacker begins nine-month accumulation of THE (Thena) tokens on Venus, funded via ~7,400 ETH from Tornado Cash; community members allegedly raise concerns; Venus declines to act
2 September 2025
Core Pool exploit: phishing attack tricks large protocol user into approving malicious transaction; approximately $27 million in vUSDT, vUSDC, and BTCB drained from Venus Core Pool
3 September 2025
Venus 'lightning vote' passes with 100% community support; forced liquidation of attacker assets recovers approximately $13.5 million; protocol fully restores services
15 March 2026
Donation attack on vTHE market: attacker donates 36+ million THE directly to vTHE contract, inflates exchange rate 3.81x, borrows ~$14.9 million in assets; THE price collapses; $2.15 million in bad debt remains
19 March 2026
XVS governance token falls approximately 9% following disclosure of bad debt; Venus pauses THE market and reduces collateral factors to zero on six additional markets
Decision Log
- hash: HymKP7mAdCyKBCPqDr9tZG4m6oVHsibsh9ECsfnvfc5B
This investigation is cryptographically anchored to the Solana blockchain (1 event). 17 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:24 AM
last updated: 8/29/2026, 6:16:46 PM
5 viewsavoid.net — verified advice for a post-truth world