• A price manipulation attack on Venus Protocol caused about $2.18 million in bad debt on BNB Chain.
• The attacker used 7,400 ETH from Tornado Cash to create collateral on Aave, borrowed $9.92M in stablecoins, pumped $THE’s price, and later used 36.1M $THE as collateral to obtain more assets.
• Investigators say the attacker profited from longs before the pump and shorts before the crash.

A market manipulation attack occurred yesterday targeting the $THE token, which triggered a security incident on the decentralized lending protocol Venus Protocol, with approximately $2.18 million in bad debt incurred due to a complex sequence of on-chain and exchange-based transactions.

The security incident was first identified around 12:00 PM UTC on Sunday after Thena’s monitoring systems identified unusual activities associated with the $THE market on Venus Protocol. The security team immediately collaborated with their partners and the Venus Protocol development team to address the security breach and mitigate its impact.

At around 12 PM UTC, our security systems flagged an incident involving $THE market on Venus Protocol. We immediately coordinated with all involved security partners and the Venus team to assess the situation.

THENA was not directly affected.

What You Need to Know:

• THENA…

— THENA (@ThenaFi) March 15, 2026

As a precautionary measure, borrowing and withdrawal transactions for the $THE asset were immediately suspended. Other markets with high levels of liquidity concentration were temporarily suspended, including those associated with Bitcoin Cash, Litecoin, Uniswap, Aave, Filecoin, and Trust Wallet Token.

How the Attack Unfolded

On-chain analysts believe the attacker carried out his plan in three steps by using decentralized finance borrowing, manipulating prices, and doing leveraged trading on centralized exchanges. The wallet linked to the exploit first received approximately 7,400 ETH through Tornado Cash. The attacker used those funds to establish collateral at Aave, which enabled him to borrow approximately $9.92 million in stablecoins.

The attacker then created multiple wallets to receive the borrowed stablecoins, after which he started buying $THE tokens aggressively. The buying activity caused the token price to rise sharply across centralized exchanges, which indicated that someone tried to increase its market value. Security analysts suspect the attacker opened large long positions on exchanges before pushing the price upward. The $THE value increase enabled those who held leveraged positions to achieve significant monetary gains.

Exploiting the Lending Market

The attacker used two wallets to deposit 36.1 million $THE tokens into Venus Protocol as collateral with the intention of creating an artificial price increase. The collateral was then used to obtain various cryptocurrency assets, which included 2,172 BNB, 1.516 million CAKE, and 20 BTC that had a total value of approximately $5.07 million during that period.

The attacker sold significant quantities of $THE tokens through centralized exchanges, which resulted in a rapid price drop. Analysts believe that the trader opened multiple large short positions, which he executed before selling; this strategy enabled him to gain from the token’s price drop. The sudden price drop resulted in multiple liquidations through Venus. The remaining collateral after liquidations started proved insufficient to settle all remaining loans.

Impact on the Crypto Market

Venus ended its liquidation process with total debt of approximately $2.18 million, which included 1.18 million CAKE and 1.84 million $THE that showed insufficient value to repay the outstanding loans. Analysts believe the attacker used leveraged trading on centralized exchanges during the pump and dump to generate profits, although on-chain transactions produced no profits when analyzed separately. The incident demonstrates that traders who use centralized exchanges and decentralized finance platforms to conduct synchronized trading can create vulnerabilities that allow them to manipulate lending markets through token price changes.

Read More Related Crypto News:

Trump Crypto Bill at Risk as Trump Threatens to Block Congress Over Voter-ID Law