Venus Protocol Loses $3.7M in Supply Cap Exploit as Aave Deploys Shield After $50M Swap Disaster
Two Protocols, Two Very Different Kinds of Pain
Venus Protocol suffered a $3.7 million exploit on BNB Chain on March 15 after an attacker manipulated the Thena (THE) token’s collateral value to drain high-liquidity assets from the platform’s Core Pool. The same day, Aave and CoW Swap published competing post-mortems on last week’s $50.4 million single-swap catastrophe, with Aave announcing a new protective mechanism called “Aave Shield” in direct response. Two incidents, two protocols, one recurring theme: DeFi’s structural vulnerabilities keep finding new expressions.
Bitcoin BTC$77,253.00▲1.44%
Ethereum ETH$2,107.85▲1.87%
Tether USDT$0.9991▲0.03%
BNB BNB$661.36▲1.72%
XRP XRP$1.35▲1.36%
USDC USDC$0.9998▲0.01%
Solana SOL$85.32▲1.47%
TRON TRX$0.3714▲1.93%
Figure Heloc FIGR_HELOC$1.03▲0.00%
Dogecoin DOGE$0.1023▲1.42%The Venus Exploit: Patience as a Weapon
This was not a smash-and-grab. The attacker spent nine months accumulating roughly 84% of THE’s circulating supply. That is not opportunism. That is a long-con against a protocol that left a door open long enough for someone to walk through it slowly.
The mechanics were precise. Rather than following the standard deposit flow, the attacker transferred THE tokens directly to the vTHE contract, bypassing Venus’s supply cap entirely. This pushed collateral positions to 53.2 million tokens, nearly 3.7 times the protocol’s limit. From that inflated base, the attacker borrowed approximately 20 BTC, 200 BNB, 1.5 million CAKE, and 1.58 million USDC before THE’s price collapsed under liquidation pressure, falling from a manipulated high of $0.563 back to $0.22.
The mechanism echoes the Mango Markets exploit of 2022, where a similar donation-based bypass was used to inflate collateral artificially. Venus has now frozen six markets including BCH, LTC, UNI, AAVE, FIL, and TWT while the investigation continues. Bad debt is estimated between $1.7 million and $2.15 million, concentrated in the CAKE market.
- Assets drained: ~20 BTC, 200 BNB, 1.5M CAKE, 1.58M USDC
- THE token price range during exploit: $0.263 to $0.563, crashing to $0.22
- Estimated bad debt: $1.7M to $2.15M
- Funding source: suspected Tornado Cash
The Aave Aftermath: When Everything Fails at Once
The $50.4 million swap disaster was a different kind of collapse. No single villain. Just a cascade of system failures stacking on top of a user who ignored a 99.9% price impact warning and clicked confirm anyway.
According to post-mortems published by both Aave and CoW Swap, the trade was initially submitted via a private RPC but leaked to the public mempool. CoW Swap’s legacy hardcoded gas ceiling rejected better routing quotes. The winning solver then failed to execute on-chain. With every efficient route blocked, a $50 million order was pushed through a SushiSwap pool holding just $73,000 in liquidity. An MEV bot spotted the exposed transaction, executed a sandwich attack, and netted $9.9 million. Titan Builder collected roughly $34 million in ETH for sequencing the blocks correctly. The user received $36,000.
Aave is now deploying Shield, which will automatically block swaps with price impact above 25% by default. CoW Swap has patched its gas ceiling. These are reasonable fixes. They are also fixes that arguably should have existed before a user lost fifty million dollars in a single click. AAVE is trading at $119.93, up 7.39% on the day, suggesting markets have decided the protocol’s response is credible.
The Pattern Nobody Wants to Name
Low-liquidity tokens used as collateral. Private transactions leaking to public mempools. Supply caps bypassed through direct contract interaction. These are not exotic edge cases. They are known attack surfaces, documented across years of DeFi history. The domain hijack on Solana’s Bonk.fun earlier this month is a different vector but the same underlying truth: protocols harden after the loss, rarely before it.
Sentiment moves fast. Capital moves faster. But the exploits keep arriving on the same schedule they always have: patient, methodical, and only visible in full once the damage is done.
