Verify a decision

{"actor":"system:backfill","investigation_id":"a6f1f6b4-01ae-4a64-8bfc-bc12b07c4d22","kind":"publish","page_slug":"venus-core-pool","published_at":"2026-05-28T01:44:40.208Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Venus Core Pool","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://academy.binance.com/en/articles/what-is-venus-protocol","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/venus","type":"other","url":""},{"credibility":3,"name":"https://coincentral.com/venus-protocol-guide/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2025/09/02/bnb-chain-based-venus-protocol-drained-of-usd27m-on-suspected-contract-compromise","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/09/03/venus-protocol-restores-services-recovers-stolen-funds-after-usd27m-exploit","type":"other","url":""},{"credibility":3,"name":"https://crypto-economy.com/venus-protocol-confirms-core-pool-exploit-27m-drained/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/09/03/venus-protocol-fully-resumes-after-27m-phishing-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/venus-protocol-rekt4","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-venus-protocol-hack-march-2026","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/393622/venus-protocol-left-with-roughly-2m-in-bad-debt-after-exploit-manipulates-thenas-the-token-price","type":"other","url":""},{"credibility":3,"name":"https://dev.to/ohmygod/the-venus-protocol-donation-attack-how-a-dismissed-audit-finding-became-a-215m-bad-debt-twice-4lk9","type":"other","url":""},{"credibility":3,"name":"https://code4rena.com/reports/2023-05-venus","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2026/03/19/venus-xvs-token-plunges-9-as-exploit-leaves-protocol-with-bad-debt","type":"other","url":""},{"credibility":3,"name":"https://protos.com/venus-protocol-hacker-lost-4-7m-after-nine-months-of-planning/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://quillhashteam.medium.com/200-m-venus-protocol-hack-analysis-b044af76a1ae","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/bscs-venus-protocol-left-with-bad-debt-after-liquidations","type":"other","url":""},{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2252203","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2252203","type":"other","url":""},{"credibility":3,"name":"https://messari.io/report/venus-money-market-and-synthetic-stablecoin-protocol-on-bnb-chain","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/246291/venus-protocol-bnb","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/binance-bridge-hacker-hit-by-usd30m-liquidation-on-venus","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/bnb-chain-team-prepares-to-step-in-to-prevent-massive-venus-protocol-liquidation","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://dev.to/ohmygod/the-venus-protocol-donation-attack-how-a-dismissed-audit-finding-became-a-215m-bad-debt-twice-4lk9","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/09/03/venus-protocol-restores-services-recovers-stolen-funds-after-usd27m-exploit","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/venus-protocol-rekt4","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2252203","type":"other","url":""},{"credibility":3,"name":"https://protos.com/venus-protocol-hacker-lost-4-7m-after-nine-months-of-planning/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=venus-protocol-bad-debt","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/03/19/donation-attack-on-venus-protocol-leaves-2-15-million-in-bad-debt/","type":"other","url":""}]}],"sources_used":[],"summary":"Venus Core Pool is the primary lending market of Venus Protocol, the largest decentralized money market on BNB Chain. The protocol has accumulated over $112 million in cumulative losses across at least five separate security incidents since 2021, including oracle manipulation, a phishing attack draining $27 million from the Core Pool itself in September 2025, and a donation-attack exploit in March 2026 that left $2.15 million in unrecoverable bad debt. A critical vulnerability flagged during a 2023 Code4rena security audit was dismissed by the development team and subsequently exploited twice.","timeline":[{"date":"2020-01-01","event":"Venus Protocol launched on BNB Chain by the Swipe Wallet development team, forking Compound and MakerDAO","source":""},{"date":"2021-05-01","event":"XVS oracle manipulation attack; attacker pumps XVS price from ~$70 to ~$140, borrows ~2,000 BTC and ~5,700 ETH; protocol left with $95 million in bad debt","source":""},{"date":"2022-05-01","event":"Terra/LUNA collapse causes $14 million in bad debt on Venus due to stale Chainlink price feed with hard-coded $0.10 minimum for LUNA","source":""},{"date":"2022-10-01","event":"BNB Chain bridge exploiter deposits 900,000 BNB as collateral on Venus to borrow $150 million in stablecoins; BNB Chain governance intervenes to prevent destabilizing liquidation","source":""},{"date":"2023-05-01","event":"Code4rena audit of Venus Isolated Pools documents donation attack vector under finding M-10; Venus development team dismisses it as 'supported behavior with no negative side effects'","source":""},{"date":"2025-02-01","event":"Venus ZKSync deployment suffers donation-style exploit on wUSDM market; approximately $717,000 in net bad debt incurred; BNB Chain deployment left unpatched","source":""},{"date":"2025-06-01","event":"Alleged attacker begins nine-month accumulation of THE (Thena) tokens on Venus, funded via ~7,400 ETH from Tornado Cash; community members allegedly raise concerns; Venus declines to act","source":""},{"date":"2025-09-02","event":"Core Pool exploit: phishing attack tricks large protocol user into approving malicious transaction; approximately $27 million in vUSDT, vUSDC, and BTCB drained from Venus Core Pool","source":""},{"date":"2025-09-03","event":"Venus 'lightning vote' passes with 100% community support; forced liquidation of attacker assets recovers approximately $13.5 million; protocol fully restores services","source":""},{"date":"2026-03-15","event":"Donation attack on vTHE market: attacker donates 36+ million THE directly to vTHE contract, inflates exchange rate 3.81x, borrows ~$14.9 million in assets; THE price collapses; $2.15 million in bad debt remains","source":""},{"date":"2026-03-19","event":"XVS governance token falls approximately 9% following disclosure of bad debt; Venus pauses THE market and reduces collateral factors to zero on six additional markets","source":""}]},"v":1}