Venus Protocol pauses after user loses funds in suspected phishing attack

Update: Venus Protocol said the protocol has been restored.

A large user of Venus Protocol, a decentralized finance lender, was drained of about $13.5 million after apparently signing a malicious transaction that granted token approvals to an attacker, blockchain security firms said on Tuesday.

Responding to the incident, Venus has paused its platform pending an investigation. “We are aware of the suspicious transaction and are actively investigating,” the team wrote on X. “Venus is currently paused following security protocols.”

PeckShield said the victim “approved a malicious transaction,” allowing address “0x7fd…6202a” to transfer assets out of the wallet.  CertiK added that the wallet had called an updateDelegate function to approve the attacker before funds were siphoned, sharing a transaction record on BNB Chain.

Also, Venus Protocol moderators told users in a Telegram message that the protocol itself “remains untouched,” though engineers are double-checking to be sure. "To clarify, Venus Protocol has NOT been exploited. A user has been attacked. Smart contract is safe," the project's X account shared amid speculation that the platform itself was exploited.

Launched in 2020, Venus Protocol is a decentralized lending market best known for its deployment on BNB Chain and additional rollouts on Ethereum, opBNB, Arbitrum, Optimism, and zkSync. It lets users supply collateral, borrow assets, and mint the VAI stablecoin, with governance via the XVS token. XVS fell as much as 9% amid the issue, before slightly recovering as of writing, Tradingview data shows.

Venus XVS token falls after a phishing scammer exploits a user. Image: TradingView

The suspected attack vector echoes a common issue in DeFi failure. Phishing scammers trick users into signing token approvals that let third parties move assets. Once granted, those allowances can be used to drain funds until permissions are revoked. According to blockchain security firm CertiK's mid-year report, phishing attacks accounted for $410 million in losses from crypto users in the first half of 2025 across 132 incidents. A separate report from Hacken, another Web3 security firm, estimates $600 million in losses specifically from phishing and social engineering schemes during the same period.