Venus Protocol Loses $3.7 Million in Attack Exploiting Thena Token Flaw

Venus Protocol is a major decentralized lending platform on BNB Chain where users can pledge tokens as collateral to borrow other assets. The incident shows that even with a supply cap, the low-liquidity Thena (THE) token’s collateral value could still be inflated through a contract “donation” mechanism, turning risk in a single market into bad debt for the protocol.

On March 15, 2026 (UTC), the attacker transferred more than 36 million THE tokens to the vTHE contract, inflating the exchange rate by 3.8 times. Using a position 3.67 times the supply cap, the attacker then borrowed about $14.9 million in CAKE, USDC, BNB and Bitcoin. The assets obtained were valued at about $3.7 million to $5.8 million, leaving Venus with roughly $2.15 million in bad debt. XVS fell more than 9% on March 19, while the platform suspended THE borrowing and withdrawals and launched an investigation.