Let’s further consider the logical possibilities of Venus Protocol being attacked: 1) Security experts say that some big investors were phished. Conventional wisdom suggests that they could just withdraw funds directly with the private key. How could there be a flash loan? Most likely, the hacker obtained updateDelegate authorization through social engineering, gaining access to the account of a large investor, but without immediate liquidity to withdraw. In layman's terms, the hacker obtained the authority, but the large investor only had collateral, not the borrowed funds. The hacker had to find a way to obtain the collateral of the large investor. 2) Is it that the individual phishing incidents involving the major investor have nothing to do with the Venus contract? As mentioned earlier, if the hacker discovered that the major investor's account had no liquidity, their efforts would normally be in vain. But why was it possible to withdraw collateral through a simple flash loan attack? The answer lies in the Venus contract mechanism. The hacker may have used flash loans and a series of vToken cross-platform exchange rate differences to help the major investor repay the collateral and even withdraw some extra. Simply put, it is true that the collateral of the big investors was stolen, but it is very likely that it will become a bad debt of the Venus contract platform, unless the big investors are stupid enough to pay back the platform. 3) While other users' funds are temporarily safe, the Venus platform faces significant liability concerns. While the attack was triggered by a large investor being phished by a social engineering scheme, the platform ultimately profited. The $30 million stolen is likely to become bad debt for the Venus platform, and coupled with the temporary panic and bank run, the impact could be devastating for Venus. But the greater impact is that this incident has brought back horrific memories of Venus's habitual attacks. The XVS price manipulation incident and its use as a tool for money laundering via BNB's cross-chain bridge are all examples of damage caused by fundamental flaws in Venus's security engineering. As the largest lending protocol on BSC, this is unacceptable. Note: The above is based on reasonable speculation based on the currently disclosed information. The details will be determined based on actual disclosed details.Let’s further consider the logical possibilities of Venus Protocol being attacked: 1) Security experts say that some big investors were phished. Conventional wisdom suggests that they could just withdraw funds directly with the private key. How could there be a flash loan? Most likely, the hacker obtained updateDelegate authorization through social engineering, gaining access to the account of a large investor, but without immediate liquidity to withdraw. In layman's terms, the hacker obtained the authority, but the large investor only had collateral, not the borrowed funds. The hacker had to find a way to obtain the collateral of the large investor. 2) Is it that the individual phishing incidents involving the major investor have nothing to do with the Venus contract? As mentioned earlier, if the hacker discovered that the major investor's account had no liquidity, their efforts would normally be in vain. But why was it possible to withdraw collateral through a simple flash loan attack? The answer lies in the Venus contract mechanism. The hacker may have used flash loans and a series of vToken cross-platform exchange rate differences to help the major investor repay the collateral and even withdraw some extra. Simply put, it is true that the collateral of the big investors was stolen, but it is very likely that it will become a bad debt of the Venus contract platform, unless the big investors are stupid enough to pay back the platform. 3) While other users' funds are temporarily safe, the Venus platform faces significant liability concerns. While the attack was triggered by a large investor being phished by a social engineering scheme, the platform ultimately profited. The $30 million stolen is likely to become bad debt for the Venus platform, and coupled with the temporary panic and bank run, the impact could be devastating for Venus. But the greater impact is that this incident has brought back horrific memories of Venus's habitual attacks. The XVS price manipulation incident and its use as a tool for money laundering via BNB's cross-chain bridge are all examples of damage caused by fundamental flaws in Venus's security engineering. As the largest lending protocol on BSC, this is unacceptable. Note: The above is based on reasonable speculation based on the currently disclosed information. The details will be determined based on actual disclosed details.

Why is it always stolen? On the systemic flaws in Venus contract design

2025/09/03 13:00
2 min read

Let’s further consider the logical possibilities of Venus Protocol being attacked:

1) Security experts say that some big investors were phished. Conventional wisdom suggests that they could just withdraw funds directly with the private key. How could there be a flash loan?

Most likely, the hacker obtained updateDelegate authorization through social engineering, gaining access to the account of a large investor, but without immediate liquidity to withdraw. In layman's terms, the hacker obtained the authority, but the large investor only had collateral, not the borrowed funds. The hacker had to find a way to obtain the collateral of the large investor.

2) Is it that the individual phishing incidents involving the major investor have nothing to do with the Venus contract? As mentioned earlier, if the hacker discovered that the major investor's account had no liquidity, their efforts would normally be in vain. But why was it possible to withdraw collateral through a simple flash loan attack? The answer lies in the Venus contract mechanism. The hacker may have used flash loans and a series of vToken cross-platform exchange rate differences to help the major investor repay the collateral and even withdraw some extra.

Simply put, it is true that the collateral of the big investors was stolen, but it is very likely that it will become a bad debt of the Venus contract platform, unless the big investors are stupid enough to pay back the platform.

3) While other users' funds are temporarily safe, the Venus platform faces significant liability concerns. While the attack was triggered by a large investor being phished by a social engineering scheme, the platform ultimately profited. The $30 million stolen is likely to become bad debt for the Venus platform, and coupled with the temporary panic and bank run, the impact could be devastating for Venus.

But the greater impact is that this incident has brought back horrific memories of Venus's habitual attacks. The XVS price manipulation incident and its use as a tool for money laundering via BNB's cross-chain bridge are all examples of damage caused by fundamental flaws in Venus's security engineering. As the largest lending protocol on BSC, this is unacceptable. Note: The above is based on reasonable speculation based on the currently disclosed information. The details will be determined based on actual disclosed details.

Market Opportunity
Binance Coin Logo
Binance Coin Price(BNB)
$635.23
$635.23$635.23
-3.54%
USD
Binance Coin (BNB) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

eurosecurity.net Expands Cryptocurrency Asset Recovery Capabilities Amid Rising Investor Losses

eurosecurity.net Expands Cryptocurrency Asset Recovery Capabilities Amid Rising Investor Losses

New York, NY/ GlobePRWire / Feb 6, 2026 – eurosecurity.net announces the expansion of its cryptocurrency asset recovery services, reflecting increased demand from
Share
CryptoReporter2026/02/06 17:24
Ethereum to boost scalability and roll out Fusaka upgrade on Dec 3

Ethereum to boost scalability and roll out Fusaka upgrade on Dec 3

Ethereum's Fusaka update may happen on December 3, based on the date set in the latest developer call.
Share
Cryptopolitan2025/09/19 17:00
Google Cloud taps EigenLayer to bring trust to agentic payments

Google Cloud taps EigenLayer to bring trust to agentic payments

The post Google Cloud taps EigenLayer to bring trust to agentic payments appeared on BitcoinEthereumNews.com. Two days after unveiling AP2 — a universal payment layer for AI agents that supports everything from credit cards to stablecoins — Google and EigenLayer have released details of their partnership to bring verifiability and restaking security to the stack, using Ethereum. In addition to enabling verifiable compute and slashing-backed payment coordination, EigenCloud will support insured and sovereign AI agents, which introduce consequences for failure or deviation from specified behavior. Sovereign agents are positioned as autonomous actors that can own property, make decisions, and execute actions independently — think smart contracts with embedded intelligence. From demos to dollars AP2 extends Google’s agent-to-agent (A2A) protocol using the HTTP 402 status code — long reserved for “payment required” — to standardize payment requests between agents across different networks. It already supports stablecoins like USDC, and Coinbase has demoed an agent checkout using its Wallet-as-a-Service. Paired with a system like Lit Protocol’s Vincent — which enforces per-action policies and key custody at signing — Google’s AP2 with EigenCloud’s verifiability and cross-chain settlement could form an end-to-end trust loop. Payments between agents aren’t as simple as they are often made to sound by “Crypto x AI” LARPs. When an AI agent requests a payment in USDC on Base and the payer’s funds are locked in ETH on Arbitrum, the transaction stalls — unless something abstracts the bridging, swapping and delivery. That’s where EigenCloud comes in. Sreeram Kannan, founder of EigenLayer, said the integration will create agents that not only run on-chain verifiable compute, but are also economically incentivized to behave within programmable bounds. Through restaked operators, EigenCloud powers a verifiable payment service that handles asset routing and chain abstraction, with dishonest behavior subject to slashing. It also introduces cryptographic accountability to the agents themselves, enabling proofs that an agent actually executed the task it…
Share
BitcoinEthereumNews2025/09/19 03:52