Ronin

Security

Venus

Decentralized finance (DeFi) lending platform Venus Protocol helped a user recover stolen crypto following a phishing attack tied to North Korea’s Lazarus Group.&nbsp;
On Thursday, Venus Protocol <a href="https://x.com/VenusProtocol/status/1963251755543839227" rel="noopener noreferrer nofollow" target="_blank">announced</a> that it had helped a user recover $13.5 million in crypto after the <a href="https://cointelegraph.com/news/defi-trader-loses-27m-phishing-scam-venus-protocol-pauses" rel="noopener noreferrer nofollow">phishing incident that occurred on Tuesday</a>. At the time, Venus Protocol paused the platform as a precautionary measure and began investigating.&nbsp;
According to Venus, the pause halted further fund movement, while audits confirmed Venus’ smart contracts and front end were uncompromised.
<h2 id="emergency-vote-enables-fund-recovery">Emergency vote enables fund recovery</h2>
An emergency governance vote allowed the forced liquidation of the attacker’s wallet, enabling stolen tokens to be seized and sent to a recovery address.&nbsp;
<figure>
 <img alt="Venus Protocol recovers user’s $13.5M stolen in phishing attack" src="https://s3.cointelegraph.com/uploads/2025-09/019914b6-2552-76d2-a7e9-5274bdb4a4bb" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/KuanSun1990/status/1963424876318134294" rel="noopener noreferrer nofollow" target="https://x.com/KuanSun1990/status/1963424876318134294">Kuan Sun</a>
 </figcaption>
</figure>
<h2 id="attackers-exploited-a-malicious-zoom-client">Attackers exploited a malicious Zoom client</h2>
In the post-mortem, Venus revealed that the attackers used a malicious Zoom client to trick the victim into granting delegated control over the account.
This allowed the perpetrators to borrow and redeem on the victim’s behalf, enabling them to drain millions in stablecoins and wrapped assets.&nbsp;
The protocol’s security partners, HExagate and Hypernative, flagged the suspicious transaction within minutes, leading to the decision to pause the protocol. According to Venus, the recovery process unfolded in less than 12 hours.&nbsp;
Kuan Sun, who was identified as the victim of the attack, <a href="https://x.com/KuanSun1990/status/1963424876318134294" rel="noopener noreferrer nofollow" target="_blank">thanked</a> the teams behind the recovery. “What could have been a total disaster turned into a battle we actually won, thanks to an incredible group of teams,” Sun wrote.
PeckShield, Binance, and SlowMist also assisted in the recovery.
Related: <a href="https://cointelegraph.com/news/wlfi-hack-attempts-blacklisting-token-launch" rel="noopener noreferrer nofollow">WLFI blocks hacking attempts with onchain blacklisting</a>
<h2 id="phishing-attack-linked-to-the-lazarus-group">Phishing attack linked to the Lazarus Group</h2>
SlowMist’s analysis linked the attack to the Lazarus Group, a North Korea-backed collective blamed for major crypto heists, including the $600M Ronin bridge exploit and the $1.5B Bybit hack.
Sun said SlowMist carried out extensive analysis work and was “among the very first to point out that Lazarus was behind this attack.”
<a href="https://cointelegraph.com/learn/articles/lazarus-group-hackers-behind-billion-dollar-heists" rel="noopener noreferrer nofollow">The Lazarus Group</a> is a North Korea-linked hacking collective believed to operate under the country’s intelligence agency.<iframe width="100%" height="315" src="https://www.youtube.com/embed/NDv0RfehETQ?start=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/astrology-could-make-you-better-crypto-trader-heres-why/" rel="noopener noreferrer nofollow">Astrology could make you a better crypto trader: It has been foretold</a>

Venus Protocol recovers user’s $13.5M stolen in phishing attack

Table of Contents

Cointelegraph

Other articles published on Sep 4, 2025

Join our free newsletter for daily crypto updates!