# Venus Protocol Recovers $13.5 Million after Phishing Attack ∞ Security

**Published:** 2025-09-17
**Categories:** Security

---

![A white, geometrically segmented sphere, partially submerged in dark blue water, dominates the foreground. Bright blue crystalline structures are visible within the sphere's open segments, while white, frothy material appears to melt into the water from its surface](https://incrypthos.com/wp-content/uploads/2025/09/immutable-ledger-shard-interacting-with-volatile-liquidity-environment.jpeg)

![The image displays a sophisticated modular mechanism featuring interconnected white central components and dark blue solar panel arrays. Intricate blue textured elements surround the metallic joints, contributing to the futuristic and functional aesthetic of the system](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-protocol-interoperability-mechanism-distributed-ledger-infrastructure.jpeg)

## Briefing

On September 2, 2025, the Venus Protocol, a decentralized finance (DeFi) lending platform, experienced a significant security incident where $13.5 million in cryptocurrency was stolen via a sophisticated phishing attack attributed to the North Korea-linked Lazarus Group. The primary consequence was the unauthorized draining of stablecoins, wrapped Bitcoin, and other tokens from a major user’s account. However, through an unprecedented [emergency governance](https://incrypthos.com/news/emergency-governance/) vote and rapid collaboration with security partners, Venus Protocol successfully recovered the entirety of the stolen funds within 12 hours, marking a landmark achievement in DeFi incident response.

![A tubular structure, formed by translucent blue rectangular segments, extends into the distance, creating a central void. This core is partially enveloped and surrounded by a dynamic, frothy white substance, resembling intricate frost or cloud-like formations](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-architecture-with-frosted-consensus-mechanism.jpeg)

## Context

Prior to this incident, the DeFi landscape has consistently faced diverse attack vectors, ranging from smart contract vulnerabilities to oracle manipulations and [social engineering](https://incrypthos.com/security/thorchain-co-founder-wallet-compromised-via-social-engineering/) tactics. While smart contract audits are standard, the prevailing attack surface often extends to off-chain elements and user-centric vulnerabilities, such as private key compromises or phishing scams. This incident leveraged a previously known class of vulnerability ∞ social engineering to gain unauthorized access ∞ highlighting the persistent risk that even robust protocol security cannot fully mitigate human element exploits.

![A detailed perspective showcases a futuristic technological apparatus, characterized by its transparent, textured blue components that appear to be either frozen liquid or a specialized cooling medium, intertwined with dark metallic structures. Bright blue light emanates from within and along the metallic edges, highlighting the intricate design and suggesting internal activity](https://incrypthos.com/wp-content/uploads/2025/09/liquid-cooling-protocol-optimizing-decentralized-ledger-technology-performance.jpeg)

## Analysis

The incident’s technical mechanics involved a phishing scam that targeted a high-value user, Kuan Sun, through a malicious Zoom client. This granted attackers [delegated control](https://incrypthos.com/news/delegated-control/) over the user’s account, enabling them to execute borrow and redeem functions on the Venus Protocol as if they were the legitimate user. The compromise did not stem from a vulnerability within Venus Protocol’s smart contracts or front-end interface, which were confirmed uncompromised by audits. Instead, the attack chain exploited the user’s off-chain environment to gain on-chain operational authority, demonstrating how external compromises can directly impact protocol integrity by subverting user credentials.

![The image displays a high-fidelity rendering of a transparent device, revealing complex internal blue components and a prominent brushed metal surface. The device's outer shell is clear, showcasing the intricate design of its inner workings](https://incrypthos.com/wp-content/uploads/2025/09/hardware-wallet-secure-enclave-transparent-cryptographic-design.jpeg)

## Parameters

- **Protocol Targeted** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **Attack Vector** ∞ [Phishing](https://incrypthos.com/news/phishing/) via malicious Zoom client leading to delegated account control

- **Attacker** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/) (North Korea-linked)

- **Financial Impact** ∞ $13.5 Million stolen, $13.5 Million recovered

- **Resolution Time** ∞ Less than 12 hours

- **Affected Asset Types** ∞ Stablecoins, [Wrapped Bitcoin](https://incrypthos.com/web3/bitcoin-hyper-launches-layer-2-solution-enhancing-bitcoin-defi/), other tokens

- **Recovery Mechanism** ∞ Emergency [governance vote](https://incrypthos.com/news/governance-vote/) and forced liquidation

![A large, faceted blue crystalline structure, reminiscent of a massive immutable ledger shard, forms the central focus, with a luminous full moon embedded within its depths. White snow or frost accents the crystal's contours, suggesting cold storage for digital assets](https://incrypthos.com/wp-content/uploads/2025/09/immutable-ledger-shard-oracle-protocol-architecture-digital-asset.jpeg)

## Outlook

This incident necessitates immediate mitigation steps for users, emphasizing rigorous operational security practices, including vigilance against phishing attempts and securing all digital communication channels. For protocols, it underscores the need for enhanced user education on off-chain security, multi-factor authentication for delegated permissions, and robust emergency response frameworks like the one demonstrated by Venus Protocol. The successful recovery through governance may establish new best practices for rapid [incident response](https://incrypthos.com/news/incident-response/) and asset retrieval, potentially influencing future auditing standards to include assessments of emergency governance capabilities and user-facing security education.

![A close-up view reveals a sleek, translucent device featuring a prominent metallic button and a subtle blue internal glow. The material appears to be a frosted polymer, with smooth, ergonomic contours](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-hardware-security-module-private-key-storage-interface.jpeg)

## Verdict

**This incident decisively proves that a well-designed emergency [governance](https://incrypthos.com/news/governance/) framework, coupled with rapid security partner collaboration, can effectively counter sophisticated off-chain attacks and restore asset integrity within the DeFi ecosystem.**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">ainvest.com</a>

## Glossary

<a href="https://incrypthos.com/news/emergency-governance/" class="glossary-item-box">

## emergency governance 

Definition ∞ Emergency governance refers to pre-defined protocols or mechanisms that allow for rapid decision-making and action in critical situations within a decentralized system. </a><a href="https://incrypthos.com/security/thorchain-co-founder-wallet-compromised-via-social-engineering/" class="glossary-item-box">

## social engineering 

A sophisticated social engineering campaign led to the compromise of a prominent individual's private key, resulting in a seven-figure asset drain. </a><a href="https://incrypthos.com/news/delegated-control/" class="glossary-item-box">

## delegated control 

Definition ∞ Delegated control refers to a system where the authority to manage or operate certain functions is transferred from one party to another. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/news/phishing/" class="glossary-item-box">

## phishing 

Definition ∞ Phishing, in the digital asset space, involves deceptive practices aimed at tricking individuals into divulging sensitive information, such as private keys or login credentials, typically through fraudulent communications. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/web3/bitcoin-hyper-launches-layer-2-solution-enhancing-bitcoin-defi/" class="glossary-item-box">

## wrapped bitcoin 

Bitcoin Hyper introduces a Solana SVM-powered Layer 2, bringing smart contract functionality and rapid DeFi capabilities to Bitcoin, addressing core scalability limitations. </a><a href="https://incrypthos.com/news/governance-vote/" class="glossary-item-box">

## governance vote 

Definition ∞ A governance vote is a mechanism within decentralized networks or protocols that allows token holders or stakeholders to make collective decisions. </a><a href="https://incrypthos.com/news/incident-response/" class="glossary-item-box">

## incident response 

Definition ∞ Incident response is the systematic process of managing and mitigating the aftermath of a security breach or operational failure. </a><a href="https://incrypthos.com/news/governance/" class="glossary-item-box">

## governance 

Definition ∞ Governance refers to the systems, processes, and rules by which an entity or system is directed and controlled. </a>

**Tags:** [Asset Protection](https://incrypthos.com/news/asset-protection/), [Supply Chain Risk](https://incrypthos.com/news/supply-chain-risk/), [DeFi](https://incrypthos.com/news/defi/), [Governance](https://incrypthos.com/news/governance/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Risk](https://incrypthos.com/news/risk/)	

## Discover More

- 
### [MetaMask Launches $mUSD Stablecoin for Simplified Web3 Transactions](https://incrypthos.com/web3/metamask-launches-musd-stablecoin-for-simplified-web3-transactions/)
![A dynamic, frosted blue and white structure, reminiscent of a stablecoin liquidity pool, dominates the foreground. Granular white and blue particles, symbolizing distributed ledger transaction data or gas fees, scatter across a reflective surface. A clear, textured oracle sphere rests amidst the token distribution, while a blurred metallic asset representation sits in the background. This visual metaphor highlights cryptographic primitives and the intricate network topology of a decentralized finance ecosystem, emphasizing protocol security.](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-primitive-frost-decentralized-ledger-governance-mechanism.jpeg)

MetaMask's introduction of $mUSD, a wallet-native stablecoin, streamlines user interaction with decentralized finance and accelerates real-world asset utility.

- 
### [SwissBorg Partner API Breach Drains Solana Assets](https://incrypthos.com/security/swissborg-partner-api-breach-drains-solana-assets/)
![A pristine white, textured material, symbolizing raw data or unverified transaction inputs, is intricately integrated with a translucent, deep blue, structured element. This blue component, representing a robust blockchain or decentralized protocol, exhibits complex, web-like patterns indicative of cryptographic proofs and distributed network connections. The interaction visually conveys on-chain data validation, asset tokenization, or smart contract execution, where initial liquidity or digital assets are secured within an immutable ledger. This highlights the consensus mechanism's role in maintaining data integrity and network security within a Web3 ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-technology-securing-digital-assets-through-protocol-execution.jpeg)

A compromised third-party API allowed attackers to drain $41.3 million in Solana tokens, exposing critical supply chain risks.

- 
### [SwissBorg Earnings Program Exploited, $41 Million Solana Tokens Lost](https://incrypthos.com/security/swissborg-earnings-program-exploited-41-million-solana-tokens-lost/)
![A close-up view depicts two futuristic, modular white components in the process of connecting, revealing intricate blue glowing internal structures. This represents the critical juncture of blockchain interoperability, facilitating seamless cross-chain communication. The dynamic data ledger transfer within these network architecture elements suggests efficient Layer-2 scaling solutions and robust protocol integration. Blurred background nodes evoke a distributed ledger technology DLT environment, emphasizing node synchronization and the execution of smart contract logic. This visual metaphor highlights transaction finality and the underlying Web3 infrastructure for secure digital asset integration.](https://incrypthos.com/wp-content/uploads/2025/09/modular-dlt-network-architecture-cross-chain-bridge-connection.jpeg)

Partner API compromise enabled significant asset exfiltration, exposing critical third-party integration risks.

- 
### [NPM Developer Credentials Compromised, Enabling Widespread Cryptocurrency Drainer Injection](https://incrypthos.com/security/npm-developer-credentials-compromised-enabling-widespread-cryptocurrency-drainer-injection/)
![A sophisticated, translucent deep blue in-ear monitor showcases its intricate internal architecture, resembling a complex smart contract network. Polished metallic elements function as secure node connectors, facilitating robust data stream integrity. The transparent outer shell hints at blockchain transparency, revealing the underlying cryptographic algorithms at play. This Web3 audio device embodies a decentralized autonomous organization DAO for personalized sound, ensuring immutable ledger fidelity. Its design suggests a hardware wallet for auditory digital assets, integrating seamlessly into a tokenized economy.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-web3-audio-gateway-immutable-ledger-integration.jpeg)

A phishing attack compromised developer credentials, allowing malicious code injection into widely used JavaScript packages, covertly draining cryptocurrency during user interactions.

- 
### [JavaScript Malware Compromises DeFi Wallet Dependencies](https://incrypthos.com/security/javascript-malware-compromises-defi-wallet-dependencies/)
![Interconnected modular components illustrate a sophisticated decentralized network architecture. White cubic units, functioning as node validators, interface with translucent blue segments revealing intricate internal circuitry representing distributed ledger technology. White conduit-like pathways symbolize secure interoperability protocols facilitating cross-chain communication and robust smart contract execution within a scalable blockchain framework, emphasizing data integrity and network security.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-network-node-validation-interoperability-protocol-modules.jpeg)

A supply chain attack injected crypto-stealing malware into widely used JavaScript packages, exposing DeFi's critical vulnerability to external software dependencies.

- 
### [Formalizing MEV: A Foundational Theory for Blockchain Security](https://incrypthos.com/research/formalizing-mev-a-foundational-theory-for-blockchain-security/)
![A macro view reveals an intricate metallic structure, possibly a 3D-printed cryptographic primitive or a blockchain architecture component. Its surface exhibits a mottled, textured pattern, reminiscent of hashed data or digital asset fragmentation. Interconnected loops suggest a node network or protocol layers within a decentralized autonomous organization DAO framework. Circular apertures could represent smart contract execution points or oracle network integration. The robust, weathered appearance emphasizes immutable ledger resilience and tamper-proof security inherent in distributed ledger technology DLT. This visual metaphor underscores the complexity of Web3 infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/distributed-ledger-technology-node-network-cryptographic-security-framework.jpeg)

This research establishes a formal theory of Maximal Extractable Value, providing a robust framework for understanding and mitigating economic attacks on blockchains.

- 
### [Polkadot DAO Approves Hard Cap for DOT Token Supply](https://incrypthos.com/web3/polkadot-dao-approves-hard-cap-for-dot-token-supply/)
![A sophisticated, high-fidelity render showcases a modular mechanical assembly, predominantly white and blue, featuring a central cylindrical processing unit. Intricate wiring and paneling suggest advanced data processing capabilities, indicative of a specialized blockchain node or validator hardware. The visible "HODL" inscription anchors its purpose within cryptocurrency investment strategies. This infrastructure supports transaction validation, consensus mechanism operations, and distributed ledger maintenance, emphasizing cryptographic security and data immutability within a decentralized network. Its design implies scalability solutions and interoperability protocols.](https://incrypthos.com/wp-content/uploads/2025/09/precision-engineered-blockchain-component-supporting-hodl-protocols.jpeg)

This strategic tokenomics shift, enacted via robust governance, establishes a finite supply for Polkadot, enhancing its appeal to long-term capital.

- 
### [Polkadot DAO Approves 2.1 Billion DOT Supply Cap](https://incrypthos.com/web3/polkadot-dao-approves-2-1-billion-dot-supply-cap/)
![A sophisticated hardware component, possibly an ASIC miner or high-performance network node, integrates with translucent blue, jagged cryogenic cooling elements. A central metallic module, potentially housing a specialized processing unit or secure enclave, is visible amidst the icy matrix. This setup suggests advanced thermal management crucial for optimal operational efficiency and hash rate stability in intensive Proof-of-Work or Proof-of-Stake validation environments. It emphasizes robust infrastructure for decentralized ledger technology, ensuring reliable transaction processing and cryptographic security.](https://incrypthos.com/wp-content/uploads/2025/09/cryogenic-cooling-module-for-high-performance-blockchain-validation-hardware.jpeg)

Polkadot's DAO decision to cap DOT supply fundamentally recalibrates its tokenomics, strategically enhancing long-term value proposition for institutional capital and network participants.

- 
### [JavaScript Supply Chain Attack Hijacks Crypto Transactions across Chains](https://incrypthos.com/security/javascript-supply-chain-attack-hijacks-crypto-transactions-across-chains/)
![A sophisticated hardware module, metallic with deep blue accents, showcases a central, glowing blue crystalline component. This secure element, likely a cryptographic processor, is engineered for robust private key management and digital asset custody. Its intricate design suggests advanced tamper-proof mechanisms and secure enclave technology, vital for blockchain security. The device facilitates offline transaction signing and seed phrase protection, essential for non-custodial self-custody within decentralized finance DeFi ecosystems, integrating multi-signature or biometric authentication for enhanced asset protection.](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-enclave-for-digital-asset-custody.jpeg)

Attackers compromise widely used JavaScript packages, replacing legitimate crypto transaction destinations with malicious addresses, posing an immediate threat to asset integrity.

**Tags:** [Asset](https://incrypthos.com/news/asset/), [Asset Protection](https://incrypthos.com/news/asset-protection/), [DeFi](https://incrypthos.com/news/defi/), [DeFi Lending](https://incrypthos.com/news/defi-lending/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Emergency Governance](https://incrypthos.com/news/emergency-governance/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance](https://incrypthos.com/news/governance/), [Governance Vote](https://incrypthos.com/news/governance-vote/), [Incident Response](https://incrypthos.com/news/incident-response/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Phishing](https://incrypthos.com/news/phishing/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol](https://incrypthos.com/news/protocol/), [Protocol Resilience](https://incrypthos.com/news/protocol-resilience/), [Recovery](https://incrypthos.com/news/recovery/), [Risk](https://incrypthos.com/news/risk/), [Security](https://incrypthos.com/news/security/), [Supply Chain Risk](https://incrypthos.com/news/supply-chain-risk/), [User Education](https://incrypthos.com/news/user-education/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol Recovers $13.5 Million after Phishing Attack",
            "item": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-after-phishing-attack/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-after-phishing-attack/"
    },
    "headline": "Venus Protocol Recovers $13.5 Million after Phishing Attack \u221e Security",
    "description": "A compromised user account, exploited via phishing, underscores the critical risk of off-chain vectors impacting on-chain asset security. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-after-phishing-attack/",
    "datePublished": "2025-09-17T09:38:49+00:00",
    "dateModified": "2025-09-17T09:38:54+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/hardware-wallet-secure-enclave-transparent-cryptographic-design.jpeg",
        "caption": "The image displays a high-fidelity rendering of a transparent device, revealing complex internal blue components and a prominent brushed metal surface. The device's outer shell is clear, showcasing the intricate design of its inner workings. This advanced hardware wallet features a transparent casing, highlighting its internal cryptographic module and secure enclave architecture. The visible blue components represent the sophisticated circuitry responsible for private key generation and secure transaction signing, essential for safeguarding digital assets. The brushed metal element likely serves as a tactile interface for user authentication or a dedicated secure element, ensuring tamper-proof cold storage. This design underscores a commitment to robust blockchain security and decentralized identity management. Such devices are pivotal for managing cryptocurrency portfolios, facilitating secure interactions with smart contracts, and participating in decentralized finance ecosystems. They offer critical protection against phishing attacks and malicious software, ensuring the integrity of seed phrases and overall digital asset sovereignty within a distributed ledger environment."
    },
    "keywords": [
        "Asset",
        "Asset Protection",
        "DeFi",
        "DeFi Lending",
        "DeFi Security",
        "Delegated Control",
        "Emergency Governance",
        "Fund Recovery",
        "Governance",
        "Governance Vote",
        "Incident Response",
        "Lazarus Group",
        "Phishing",
        "Phishing Attack",
        "Protocol",
        "Protocol Resilience",
        "Recovery",
        "Risk",
        "Security",
        "Supply Chain Risk",
        "User Education"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-recovers-13-5-million-after-phishing-attack/
