A Coordinated Cross-Market Attack?
On March 15, Venus Protocol experienced a major liquidation anomaly that sent shockwaves through the DeFi community. Chain analysis reveals a single address—originally receiving 7,400 ETH through a privacy-preserving channel—as the central actor behind the exploit.
This entity rapidly deposited the funds into Aave, borrowing nearly $9.92 million in stablecoins (USDT, DAI, USDC), which were then distributed across multiple wallets to accumulate large volumes of THE tokens.
The Three-Phase Play: Pump, Borrow, Crash
At approximately 8:00 PM, the operator appeared to inflate THE’s price on centralized exchanges—likely after establishing long positions. They then deposited 36.1 million THE into Venus as collateral, extracting high-value assets including BTC, BNB, and CAKE.
Less than 40 minutes later, THE’s price collapsed. As collateral value plummeted, Venus initiated forced liquidations, but the sudden sell-off overwhelmed market depth, accelerating the decline and triggering a cascade effect.
Liquidation Failure and Protocol Exposure
The position was fully liquidated, yet a deficit of $2.15 million remained—covering 1.18 million CAKE and 1.84 million THE. This shortfall became a direct loss for the protocol, highlighting systemic vulnerabilities in handling manipulated assets.
- The attacker only withdrew $5.07M on-chain, suggesting profits were realized off-chain
- No clear on-chain gain indicates external short positions were likely in play
- Strong evidence points to pre-positioned shorts on CEXs as the real profit engine
This incident underscores a growing threat: coordinated on-chain borrowing with off-exchange price manipulation. Future DeFi protocols must enhance oracle resilience and implement adaptive liquidation safeguards to withstand such hybrid attacks.