DeFi

Read

Security

Venus

<p>Venus Protocol has recovered funds lost in a phishing attack after swift intervention involving a governance vote.</p>
<div id="cn-block-summary-block_521be0685ec2c0c26208a50cc8d00847" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">
  <span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>A Venus Protocol whale wallet was drained in a phishing attack which led to an estimated $13.5 million loss</li>
   <li>Venus paused the protocol and used governance powers to liquidate the attacker’s positions.</li>
   <li>The recovery steadied XVS price, but raised questions about decentralization in crisis management.</li>
  </ul>
 </div>
</div>
<p>Venus Protocol, one of the largest lending platforms on BNB (<a href="https://crypto.news/price/bnb/" target="_blank" rel="noopener noreferrer nofollow">BNB</a>) Chain, has recovered around $13.5 million lost in a phishing incident. The <a href="https://x.com/venusprotocol/status/1963017766098907282?s=46&amp;t=nznXkss3debX8JIhNzHmzw" target="_blank" rel="noopener noreferrer nofollow">update</a> was shared by the platform on Sept. 3, confirming the assets had been fully restored.</p>
<h2 class="wp-block-heading" id="whale-wallet-compromised">Whale wallet compromised</h2>
<p>On Sept. 2, a high-value Venus user lost control of assets worth around $13.5 million after approving a malicious transaction. Security firms initially estimated losses of up to $27 million, but they later modified these figures to take the user’s debt position into consideration.&nbsp;</p>
<p>Among the stolen assets were wrapped Bitcoin (BTCB), vUSDT, vUSDC, vXRP, and vETH. Notably, this was a user-level compromise rather than a breach of Venus’ smart contracts, demonstrating the ongoing risk of social engineering even in DeFi.</p>
<p>You might also like: <a href="https://crypto.news/wlfi-crypto-holders-targeted-by-phishing-attacks-at-scale-post-launch/" rel="noopener noreferrer nofollow"> WLFI crypto holders targeted by phishing attacks at scale post launch </a></p>
<h2 class="wp-block-heading" id="swift-response-and-recovery">Swift response and recovery</h2>
<p>In order to prevent the attacker from moving funds or closing positions, Venus instantly <a href="https://crypto.news/venus-protocol-pauses-after-13-5m-phishing-attack-hits-major-wallet/" target="_blank" rel="noopener noreferrer nofollow">paused</a> the protocol. The pause stopped the exploiter’s activity and bought time for an emergency governance vote.</p>
<p>By approving the forced liquidation of the attacker’s holdings, the community was able to secure the stolen assets before they could be mixed or bridged.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Update: Venus Protocol has been fully restored (withdrawals and liquidations resumed) as of 9:58PM UTC. ✅<br><br>The lost funds have been recovered under Venus' protection. ✅ <a href="https://t.co/y2uUwPqmtb" rel="noopener noreferrer nofollow">https://t.co/y2uUwPqmtb</a></p>— Venus Protocol (@VenusProtocol) <a href="https://twitter.com/VenusProtocol/status/1963017766098907282?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 2, 2025</a>
  </blockquote>
 </div>
</figure>
<p>By Sept. 3, security firm PeckShield confirmed that the funds had been restored. Transactions on BNB Chain show the recovery in action, with assets returned to protocol reserves. Venus announced full resumption of operations at 9:58 PM UTC after completing security checks.</p>
<h2 class="wp-block-heading" id="market-and-community-reaction">Market and community reaction</h2>
<p>XVS, Venus’s governance token, initially dropped nearly 10% on the news, with a surge in trading volume as users rushed to assess the damage. After the recovery efforts were confirmed, the token stabilized, showing renewed confidence.&nbsp;</p>
<p>The result, which is a rare complete recovery of stolen funds, was made possible by Venus’s emergency tools. However, it has spurred debate about centralization in DeFi because multisig intervention was required to stop the protocol and force liquidations.</p>
<p>Venus said it will release a detailed post-mortem, but emphasized that the protocol itself remained secure.</p>
<p>Phishing <a href="https://crypto.news/defi-loses-1-2m-fake-uniswap-site-phishing-scams-flood-google-ads/" target="_blank" rel="noopener noreferrer nofollow">attacks</a> have become common in the crypto industry. As opposed to protocol exploits, social engineering relies on user error and avoids code audits, typically through malicious pop-ups or spoof websites.&nbsp;</p>
<p>Read more: <a href="https://crypto.news/fake-aave-ads-top-google-top-search-results-again-targets-investors-with-phishing-links/" rel="noopener noreferrer nofollow"> Fake Aave ads top Google top search results again, targets investors with phishing links </a></p>

Venus Protocol recovers $13.5M lost in phishing attack

Table of Contents

crypto.news

Other articles published on Sep 3, 2025

Join our free newsletter for daily crypto updates!