Finance
Share this article

Venus Protocol Restores Services, Recovers Stolen Funds After $27M Exploit

The DeFi lender paused withdrawals and liquidations after a malicious contract update drained tens of millions.

By Oliver Knight|Edited by Sheldon Reback
Sep 3, 2025, 9:31 a.m.
Under a low-light red lamp, a pair of hands types on a keyboard. (Wesley Tingey/Unsplash+)
Venus protocol restored services after an exploit (Wesley Tingey/Unsplash+)

What to know:

  • Venus Protocol resumed operations after recovering $27 million was siphoned away via a malicious contract update.
  • The pause allowed security teams to verify that user funds and the platform’s front end were uncompromised.
  • Native token XVS remains down 2.69% over the past 24 hours despite assurances of fund safety.

Venus Protocol, a major lending platform on BNB Chain, said it fully restored operations after suspending withdrawals and liquidations in response to a suspected exploit on Tuesday.

The protocol confirmed on Wednesday that lost funds had been recovered and that the pause allowed security teams to complete full checks to ensure its front end was not compromised.

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
By signing up, you will receive emails about CoinDesk products and you agree to our terms & conditions and privacy policy.

The incident, which stemmed from a malicious contract update that drained an estimated $27 million, prompted Venus to halt key functions while investigating.

On-chain sleuths had initially flagged suspicious movements from the platform’s Core Pool Comptroller contract, which seemed to route user assets including vUSDC and vETH to the hacker's wallet.

Despite the platform’s reassurance that funds are safe, Venus’ native token, XVS, remains down 2.69% over the past 24 hours, following a sell-off on Tuesday.

Venus said it will release a full post-mortem of the incident in due course while expressing its gratitude to the community for support during a "critical moment" on X.

It emphasized that the pause was “necessary not just to secure the phished funds, but to conduct full security checks.”

VenusLendingExploit