Venus’ XVS token plunges 9% as exploit leaves protocol with bad debt

The governance token of Venus (XVS), a prominent BNB Chain-based money market, has experienced a significant drop of over 9% in 24 hours. This decline follows an exploit that occurred on March 16, resulting in approximately $2.15 million in bad debt for the protocol. The price impact was not immediate, becoming apparent only after analysis revealed large amounts of XVS being moved to exchanges by major holders, including wallets associated with Justin Sun.

Exploit Details and Attacker's Method

The exploit targeted Venus' Thena market. According to the protocol, the attacker spent roughly nine months accumulating a substantial position in Thena's THE token. This accumulation was reportedly funded by 7,400 ETH withdrawn from the mixing protocol Tornado Cash. The attacker then directly donated over 36 million THE to the vTHE contract, bypassing standard cap checks. This action inflated the market's exchange rate for THE by approximately 3.8 times.

Leveraging this inflated value, the attacker used THE as collateral to borrow other assets and subsequently purchased more THE in a thinly traded market. This activity pushed the price of THE from around $0.26 to nearly $0.56. Venus clarified that this was not a flash-loan attack, its oracles remained functional, and Venus Flux was unaffected.

Consequences and Protocol Response

When the attacker began selling THE, its price plummeted by over 17% in less than a day, triggering liquidations. Analysis suggests that between $3.7 million and $5.8 million in assets, including tokenized bitcoin, BNB, and stablecoins, were withdrawn before liquidations could fully take effect. The primary damage was concentrated on the THE token and, to a lesser extent, CAKE. Importantly, no user funds outside the affected pools were lost.

In response, Venus has paused THE borrows and withdrawals, set THE's collateral value to zero, and strengthened rules for other identified at-risk markets, including those for BCH, LTC, and AAVE. The protocol noted that the attacking address had been flagged by the community prior to the incident, but no action was taken as no rules had been broken at that time. Venus emphasized its nature as a decentralized and permissionless protocol, stating it cannot freeze addresses based on suspicion alone, highlighting a known tension in DeFi.

Financial Implications and Future Coverage

The protocol's governance is expected to determine how the $2.15 million loss will be covered, likely utilizing Venus's risk fund. The incident occurred amidst a broader market downturn, with the CoinDesk 20 (CD20) index also experiencing a 4.6% decline during the same period.