Venus Protocol pauses after user loses funds in suspected phishing attack
Quick Take Venus Protocol paused markets after a whale lost an estimated $13.5 million in a suspected phishing attack. Security firms say the victim approved a malicious address. The DeFi lender states that the protocol itself remains unaffected pending further checks.
A large user of Venus Protocol, a decentralized finance lender, was drained of about $13.5 million after apparently signing a malicious transaction that granted token approvals to an attacker, blockchain security firms said on Tuesday.
Responding to the incident, Venus has paused its platform pending an investigation. “We are aware of the suspicious transaction and are actively investigating,” the team wrote on X. “Venus is currently paused following security protocols.”
PeckShield said the victim “approved a malicious transaction,” allowing address “0x7fd…6202a” to transfer assets out of the wallet. CertiK added that the wallet had called an updateDelegate function to approve the attacker before funds were siphoned, sharing a transaction record on BNB Chain.
Also, Venus Protocol moderators told users in a Telegram message that the protocol itself “remains untouched,” though engineers are double-checking to be sure. "To clarify, Venus Protocol has NOT been exploited. A user has been attacked. Smart contract is safe," the project's X account shared amid speculation that the platform itself was exploited.
Launched in 2020, Venus Protocol is a decentralized lending market best known for its deployment on BNB Chain and additional rollouts on Ethereum, opBNB, Arbitrum, Optimism, and zkSync. It lets users supply collateral, borrow assets, and mint the VAI stablecoin, with governance via the XVS token. XVS fell as much as 9% amid the issue, before slightly recovering as of writing, Tradingview data shows.
Venus XVS token falls after a phishing scammer exploits a user. Image: TradingView
The suspected attack vector echoes a common issue in DeFi failure. Phishing scammers trick users into signing token approvals that let third parties move assets. Once granted, those allowances can be used to drain funds until permissions are revoked. According to blockchain security firm CertiK's mid-year report , phishing attacks accounted for $410 million in losses from crypto users in the first half of 2025 across 132 incidents. A separate report from Hacken , another Web3 security firm, estimates $600 million in losses specifically from phishing and social engineering schemes during the same period.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
From Spotlight to the Sidelines: The Bubble Burst of 8 Star VC-Backed Projects
Is it because the model is unsustainable, the ecosystem has yet to launch, the competitors are too strong, or is there simply insufficient market demand?

The Next "Black Swan": "Tariff Refund Mega Deal", Wall Street and Individual Investors Are Placing Bets
Individual investors are participating in this game through emerging prediction markets such as Kalshi and Polymarket.

Since the U.S. legislation in July, stablecoin usage has surged by 70%!
After the "Genius Act" was passed in the United States, stablecoin payment volumes surged, with August transactions exceeding 10 billion USD. Nearly two-thirds of this amount came from inter-company transfers, making it the main driving force.

BlackRock Shifts $500 Million Funds to Polygon Network
In Brief BlackRock transfers $500 million to Polygon, enhancing blockchain integration in finance. The move shows increased trust in blockchain-based financial structures. It indicates a trend towards decentralization and long-term structural change in finance.

