Venus Protocol pauses after user loses funds in suspected phishing attack
Quick Take Venus Protocol paused markets after a whale lost an estimated $13.5 million in a suspected phishing attack. Security firms say the victim approved a malicious address. The DeFi lender states that the protocol itself remains unaffected pending further checks.

A large user of Venus Protocol, a decentralized finance lender, was drained of about $13.5 million after apparently signing a malicious transaction that granted token approvals to an attacker, blockchain security firms said on Tuesday.
Responding to the incident, Venus has paused its platform pending an investigation. “We are aware of the suspicious transaction and are actively investigating,” the team wrote on X. “Venus is currently paused following security protocols.”
PeckShield said the victim “approved a malicious transaction,” allowing address “0x7fd…6202a” to transfer assets out of the wallet. CertiK added that the wallet had called an updateDelegate function to approve the attacker before funds were siphoned, sharing a transaction record on BNB Chain.
Also, Venus Protocol moderators told users in a Telegram message that the protocol itself “remains untouched,” though engineers are double-checking to be sure. "To clarify, Venus Protocol has NOT been exploited. A user has been attacked. Smart contract is safe," the project's X account shared amid speculation that the platform itself was exploited.
Launched in 2020, Venus Protocol is a decentralized lending market best known for its deployment on BNB Chain and additional rollouts on Ethereum, opBNB, Arbitrum, Optimism, and zkSync. It lets users supply collateral, borrow assets, and mint the VAI stablecoin, with governance via the XVS token. XVS fell as much as 9% amid the issue, before slightly recovering as of writing, Tradingview data shows.
Venus XVS token falls after a phishing scammer exploits a user. Image: TradingView
The suspected attack vector echoes a common issue in DeFi failure. Phishing scammers trick users into signing token approvals that let third parties move assets. Once granted, those allowances can be used to drain funds until permissions are revoked. According to blockchain security firm CertiK's mid-year report , phishing attacks accounted for $410 million in losses from crypto users in the first half of 2025 across 132 incidents. A separate report from Hacken , another Web3 security firm, estimates $600 million in losses specifically from phishing and social engineering schemes during the same period.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Toyota Launches Blockchain Solution to Transform Vehicles Into Digital Assets

SEC Eyes Cross-Border Crypto Pump-and-Dump Enforcement, Could Include Bitcoin Cases

Michael Saylor’s Net Worth May Be Linked to MicroStrategy Stock Gains and Large Bitcoin Holdings

Traders Weigh Which Major Asset May Lead Next Move as Bitcoin Remains Indecisive and Sentiment Cools

Trending news
MoreCrypto prices
More








