Venus released a preliminary analysis of hacking methods and reduced the collateral factors for 7 markets to 0

Venus Protocol releases updates on the abnormal activity in the THE liquidity pool. In addition to previously suspending THE borrowing and withdrawals, the collateral factors (CF) for 7 markets have now been reduced to 0 as a precautionary measure against markets where a single user holds an excessively high proportion of collateral. The 7 markets are BCH, LTC, UNI, AAVE, FIL, TWT, and lisUSD, while all other markets remain unaffected and continue normal operations.

The preliminary assessment of the attack method indicates that the attacker began accumulating THE tokens slowly through normal deposit processes starting in June 2025, ultimately holding 84% of the maximum limit (approximately 12.2 million THE). Yesterday, the hacker directly transferred THE tokens into the protocol contract, instantly increasing the supply and creating a massive amount of collateral. They then engaged in recursive price manipulation, taking advantage of the extremely low on-chain liquidity of THE combined with the delay of the TWAP oracle. The hacker initiated a loop: depositing THE, borrowing other assets, using the borrowed assets to buy more THE on-chain, and waiting for the TWAP oracle to update and push the price higher. Venus stated that it is committed to transparency and will release a complete report after the investigation is concluded.