Venus Protocol - Rekt IV

An attacker exploited a donation attack on Venus Protocol's THE market on BNB Chain on March 15, 2026, bypassing the supply cap by transferring tokens directly to the vTHE contract and leaving Venus with $2.15 million in bad debt. The March 17 post-mortem says the vector was identified in a 2023 Code4rena audit, assessed as having "no negative side effects," and not remediated. The attacker built an 84% supply-cap position over nine months and extracted about $3.7 million in net assets before liquidation. William Li flagged the suspicious activity and posted the attacker's address before Venus made a public statement.