Some crypto protocols have suffered multiple successful attacks and exploits over the years. Venus Protocol is a recent example: an attacker executed their multi-month plan this past Sunday, reportedly leaving the platform with around $2 million in bad debt.

After confirming that the decentralized finance (DeFi) protocol suffered an incident with one of its crypto pools, Venus Protocol shared the findings of its "risk manager," Allez Labs.

The team concluded that someone had orchestrated a supply cap manipulation attack on the protocol's Core Pool on the BNBChain blockchain. Apparently, it took months to execute the plan.

According to Allez Labs, the criminal accumulated 84% of the THENA (THE) token supply in the past nine months and, after some intermediary steps, they managed to build a large collateral position and exploit the fact that THE is an illiquid asset, meaning that a relatively small transaction can result in a large price move.

Blockchain researcher Weillin Li was the first to warn about the attack and concluded that it was "a very classic Mango Markets-style price manipulation attack," referring to the 2022 exploit of the Mango Markets platform. Li even co-authored a related academic paper exploring this type of crime.

In the case of Venus, according to Li, the attacker deposited THE as collateral, then borrowed other assets to buy more THE and push the token's price higher, repeating the loop until THE's price skyrocketed from $0.27 to almost $5. However, per the researcher, after the first phase of the attack, the price stabilized around $0.5.

"At that point, the attacker had already extracted significant borrowed assets and could have stopped there. But apparently, they wanted more," Li said, adding that the criminal kept deploying borrowed funds to buy more THE, trying to push the price higher, but this was where "things started to break down."

Eventually, the attacker’s collateral reached a nominal value of around $30 million, but the market was too small to absorb this amount of THE. As the market chaos unraveled, existing holders began selling the token, and the price crashed. At the time of writing, it is trading near $0.21.

Meanwhile, per Li's data, this manipulation left Venus with around $2 million in bad debt, while the researcher, who noticed the brewing storm and shorted the market, made around $15,000 in profit. However, it's unclear whether the attacker made any substantial profit at all.

It's not the first time the Venus Protocol has been exploited. A manipulation attack in 2021 resulted in more than $95 million in bad debt. Last year, the team suffered a $700,000 attack, while one of their users lost almost $14 million in a phishing attack. Luckily, the stolen funds were fully recovered.

Unlock more exclusive Cybernews content on YouTube.