# Venus Protocol Recovers $13.5 Million from Lazarus Group Phishing Attack ∞ Security

**Published:** 2025-09-17
**Categories:** Security

---

![A detailed sphere, resembling the moon with visible craters and textures, is suspended above and between a series of parallel and intersecting metallic and translucent blue rails. These structural elements create a dynamic, abstract pathway system against a muted grey background](https://incrypthos.com/wp-content/uploads/2025/09/oracle-sphere-traversing-decentralized-network-data-pathways.jpeg)

![A close-up view reveals a sleek, translucent device featuring a prominent metallic button and a subtle blue internal glow. The material appears to be a frosted polymer, with smooth, ergonomic contours](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-hardware-security-module-private-key-storage-interface.jpeg)

## Briefing

Venus Protocol successfully recovered $13.5 million in cryptocurrency following a sophisticated phishing attack attributed to the North Korea-linked Lazarus Group. The incident, which occurred on September 2, 2025, exploited a major user’s delegated account control through a malicious Zoom client, enabling the attackers to illicitly borrow and redeem assets. This rapid recovery, executed within 12 hours via an [emergency governance](https://incrypthos.com/news/emergency-governance/) vote, marks a significant precedent in DeFi security, preventing a total loss of the initially drained funds.

![The image displays a detailed view of a futuristic device, highlighting a circular port filled with illuminated blue crystalline elements and surrounded by white, frosty material. Modular white and dark grey components make up the device's exterior, suggesting complex internal mechanisms](https://incrypthos.com/wp-content/uploads/2025/09/cold-storage-hardware-wallet-blockchain-node-cryptographic-security.jpeg)

## Context

Prior to this incident, the DeFi landscape has consistently faced persistent threats from state-sponsored actors and sophisticated cybercriminals targeting various attack surfaces, including social engineering vectors. While smart contract audits are standard, off-chain vulnerabilities like phishing remain a critical, often underestimated, risk. This incident highlights the ongoing challenge of securing [delegated permissions](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) and user-side operational security within decentralized ecosystems.

![The image showcases a highly detailed, futuristic white and metallic modular structure, resembling a satellite or advanced scientific instrument, featuring several blue-hued solar panel arrays. Its intricate components are precisely interconnected, highlighting sophisticated engineering and design](https://incrypthos.com/wp-content/uploads/2025/09/modular-dlt-framework-enhancing-cross-chain-digital-asset-management.jpeg)

## Analysis

The attack vector was not a smart contract exploit but a targeted phishing campaign. Attackers leveraged a malicious Zoom client to compromise a major user’s system, subsequently gaining [delegated control](https://incrypthos.com/news/delegated-control/) over their Venus Protocol account. This unauthorized access allowed the Lazarus Group to initiate borrowing and redemption transactions, effectively draining stablecoins, wrapped Bitcoin, and other tokens from the user’s account. The success of the attack hinged on exploiting the trust placed in delegated permissions and the user’s compromised environment, bypassing the protocol’s core smart contract integrity.

![A striking visual features a white, futuristic modular cube, with its upper section partially open, revealing a vibrant blue, glowing internal mechanism. This central component emanates small, bright particles, set against a softly blurred, blue-toned background suggesting a digital or ethereal environment](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-node-processing-digital-assets-securely-on-chain.jpeg)

## Parameters

- **Protocol Targeted** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **Attack Vector** ∞ Phishing / Delegated [Account Compromise](https://incrypthos.com/news/account-compromise/)

- **Attacker Group** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/)

- **Funds Recovered** ∞ $13.5 Million

- **Resolution Time** ∞ Under 12 Hours

- **Blockchain** ∞ BNB Chain (Implied)

![A futuristic, multi-segmented white device with visible internal components and solar panels is partially submerged in turbulent blue water. The water actively splashes around the device, creating numerous bubbles and visible ripples across the surface](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-oracle-node-resiliency-cross-chain-data-stream-recovery.jpeg)

## Outlook

This incident underscores the critical need for enhanced [user education](https://incrypthos.com/news/user-education/) on phishing threats and robust off-chain security practices, particularly concerning delegated access. Protocols should evaluate their emergency response mechanisms, including the efficacy of governance-led fund recovery, as a potential mitigation strategy against similar attacks. The successful recovery by Venus Protocol may set a new standard for crisis management and could prompt other DeFi platforms to integrate similar emergency governance powers, albeit raising ongoing debates about decentralization versus security.

![A metallic, silver-toned electronic component, featuring intricate details and connection points, is partially enveloped by a translucent, vibrant blue, fluid-like substance. The substance forms a protective, organic-looking casing around the component, with light reflecting off its glossy surfaces, highlighting its depth and smooth contours against a soft grey background](https://incrypthos.com/wp-content/uploads/2025/09/digital-asset-encapsulation-blockchain-hardware-wallet-interface.jpeg)

## Verdict

**The Venus Protocol recovery demonstrates that proactive governance and rapid incident response can significantly mitigate the impact of sophisticated off-chain attacks, shifting the paradigm for [DeFi security](https://incrypthos.com/news/defi-security/).**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">AInvest</a>

## Glossary

<a href="https://incrypthos.com/news/emergency-governance/" class="glossary-item-box">

## emergency governance 

Definition ∞ Emergency governance refers to pre-defined protocols or mechanisms that allow for rapid decision-making and action in critical situations within a decentralized system. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated permissions 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/news/delegated-control/" class="glossary-item-box">

## delegated control 

Definition ∞ Delegated control refers to a system where the authority to manage or operate certain functions is transferred from one party to another. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/news/account-compromise/" class="glossary-item-box">

## account compromise 

Definition ∞ An account compromise signifies an unauthorized intrusion into a user's digital asset or cryptocurrency account. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/news/user-education/" class="glossary-item-box">

## user education 

Definition ∞ User Education in the context of digital assets and blockchain technology refers to the provision of information and resources designed to inform individuals about the functionality, risks, and best practices associated with these technologies. </a><a href="https://incrypthos.com/news/defi-security/" class="glossary-item-box">

## defi security 

Definition ∞ DeFi security pertains to the measures and practices employed to safeguard decentralized finance applications and user assets from threats. </a>

**Tags:** [Governance](https://incrypthos.com/news/governance/), [Protocol Safeguard](https://incrypthos.com/news/protocol-safeguard/), [Account Compromise](https://incrypthos.com/news/account-compromise/), [Asset Drain](https://incrypthos.com/news/asset-drain/), [Asset Protection](https://incrypthos.com/news/asset-protection/), [Emergency Governance](https://incrypthos.com/news/emergency-governance/)	

## Discover More

- 
### [Fed Rate Cut Expected, Boosting Crypto Market Outlook](https://incrypthos.com/markets/fed-rate-cut-expected-boosting-crypto-market-outlook/)
![A futuristic white and metallic cylindrical apparatus, partially submerged in dark blue water, actively processes. Its open end reveals intricate, glowing blue crystalline structures, indicative of intensive cryptographic operations. From this aperture, a torrent of white, granular material and vibrant blue particles forcefully ejects, signifying substantial liquidity injection. This represents a blockchain infrastructure's robust consensus mechanism generating digital asset issuance or executing complex smart contract logic, impacting network throughput within the DLT ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/dlt-mechanism-emitting-liquidity-into-crypto-ecosystem-protocol-activation.jpeg)

The Federal Reserve's anticipated rate cut could inject fresh liquidity into crypto, signaling a potential bullish shift for digital assets.

- 
### [Multi-Signature Wallet Drained by Sophisticated Phishing Attack](https://incrypthos.com/security/multi-signature-wallet-drained-by-sophisticated-phishing-attack/)
![A sleek, translucent blue device, possibly a next-generation hardware wallet, features a brushed metallic surface for biometric authentication. This secure element facilitates robust private key management and on-chain transaction signing, crucial for decentralized asset custody. Its advanced cryptographic security ensures cold storage protection against unauthorized access. The design suggests seamless Web3 integration and efficient dApp interaction, supporting multi-signature protocols and future-proofing against quantum resistance threats. This non-custodial solution enhances user control over digital assets.](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-biometric-authentication-for-decentralized-asset-custody.jpeg)

A deceptive phishing attack leveraged fake Etherscan verification and Safe Multi Send to bypass multi-signature wallet security, resulting in significant asset loss.

- 
### [Formalizing Maximal Extractable Value for Blockchain Security Proofs](https://incrypthos.com/research/formalizing-maximal-extractable-value-for-blockchain-security-proofs/)
![A close-up, angled view reveals a sophisticated, modular metallic mechanism featuring a vibrant blue core, intricately layered with white crystalline frost. This apparatus, reminiscent of a hardware security module HSM, underscores the critical role of cold storage in safeguarding digital assets. The visible cryptographic freezing effect symbolizes robust data integrity and immutability essential for blockchain protocol security, preventing unauthorized smart contract execution within a distributed ledger environment. Its design evokes high-performance, secure computational infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/advanced-cryogenic-data-processing-unit-securing-blockchain-protocol-integrity.jpeg)

This research establishes a rigorous, abstract theory of MEV, enabling formal security proofs against economic attacks that exploit transaction ordering.

- 
### [Protocol-Native MEV Brokering Enhances Blockchain Economic Fairness](https://incrypthos.com/research/protocol-native-mev-brokering-enhances-blockchain-economic-fairness/)
![A futuristic, segmented white sphere, emblematic of a blockchain protocol or network node, partially submerged in dark, reflective water. From its central aperture, vibrant blue, crystalline substance, symbolizing generated digital assets or staking rewards, emerges, forming an icy mass. This illustrates value creation within a decentralized finance DeFi ecosystem, suggesting a smart contract autonomously issuing tokens or distributing yield from a liquidity pool. The 'frozen' aesthetic implies assets in cold storage or locked in a Proof-of-Stake PoS consensus mechanism, highlighting immutable ledger and tokenomics.](https://incrypthos.com/wp-content/uploads/2025/09/modular-protocol-emitting-frozen-digital-assets-into-liquidity-pools.jpeg)

A novel ticketing mechanism directly integrates Maximal Extractable Value distribution into the Ethereum protocol, fundamentally reshaping network economics.

- 
### [Solana Network Extensions Enable Unified Custom Execution Environments](https://incrypthos.com/tech/solana-network-extensions-enable-unified-custom-execution-environments/)
![A sculptural object, split vertically, showcases intricate internal structures. Deep blue translucent material forms the outer shell, suggesting a protocol's external interface, while interwoven white, textured layers represent complex data blocks and transactional history. The precise bifurcation highlights a chain split or hard fork, exposing the underlying distributed ledger technology DLT. This visual metaphor illustrates the immutability and data integrity within a blockchain's architecture, revealing how consensus mechanisms maintain network stability even during protocol divergence. The layered white elements evoke sharding or layer-2 solutions within the cryptographic primitives.](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-protocol-bifurcation-revealing-layered-ledger-architecture.jpeg)

Solana's network extensions introduce bespoke Layer 1 execution environments, preserving unified state and composability while fostering application-specific optimization.

- 
### [Nemo Protocol Suffers $2.6 Million Exploit from Unaudited Code](https://incrypthos.com/security/nemo-protocol-suffers-2-6-million-exploit-from-unaudited-code/)
![White, modular, metallic components connect in a chain-like fashion, forming a futuristic processing unit. Vibrant blue liquid or energy vigorously flows and splashes within an open central segment, propelled by internal mechanisms. This represents a high-performance distributed ledger technology DLT system, where transaction throughput is optimized. The dynamic blue flow symbolizes liquidity pools and on-chain data streams being processed by validator nodes within a modular blockchain architecture. It highlights efficient smart contract execution and cross-chain interoperability, essential for robust DeFi protocols and scalable Web3 infrastructure, underpinned by secure cryptographic primitives across a decentralized network.](https://incrypthos.com/wp-content/uploads/2025/09/modular-protocol-engine-executing-high-velocity-liquidity-pool-transactions.jpeg)

A publicly exposed flash loan function and state-modifying query vulnerability allowed unauthorized asset drainage, posing a critical risk to protocol integrity.

- 
### [Boundless Mainnet Launches, Pioneering Verifiable Compute for Internet-Scale Blockchains](https://incrypthos.com/web3/boundless-mainnet-launches-pioneering-verifiable-compute-for-internet-scale-blockchains/)
![A sophisticated white and blue modular electronic component, prominently featuring an Application-Specific Integrated Circuit ASIC with a distinct blue frame, integrates into a larger system. This specialized hardware suggests a critical role in decentralized physical infrastructure networks DePIN. Its precise engineering implies robust computational integrity, essential for validator nodes and high-throughput transaction processing within a distributed ledger technology DLT framework. The modular design supports scalable network architecture and efficient smart contract execution, underpinning secure multi-party computation MPC and cryptographic primitives for Web3 functionality.](https://incrypthos.com/wp-content/uploads/2025/09/modular-asic-node-facilitating-decentralized-ledger-transaction-integrity.jpeg)

Boundless activates its mainnet, introducing Proof of Verifiable Work to redefine blockchain scalability by incentivizing verifiable computation, fostering a new primitive for cross-chain application development.

- 
### [Pump.fun Revenue and Volume Soar, Driving Solana Memecoin Ecosystem](https://incrypthos.com/web3/pump-fun-revenue-and-volume-soar-driving-solana-memecoin-ecosystem/)
![A close-up view reveals a complex, translucent structure, predominantly frosted clear with deep blue internal elements, suggesting intricate blockchain architecture. The smooth, interconnected forms evoke decentralized ledger data flow and smart contract logic. Metallic, angular components on the periphery hint at validator nodes or hardware security modules. This visual metaphor underscores cryptographic primitive integrity and protocol transparency within a Web3 ecosystem, emphasizing data immutability and network infrastructure resilience for digital assets.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-decentralized-ledger-architecture-visualizing-protocol-interoperability.jpeg)

Pump.fun's surge in revenue and trading volume, driven by strategic buybacks and creator incentives, redefines meme coin launchpad economics and amplifies Solana's application layer vibrancy.

- 
### [Formalizing Maximal Extractable Value for Robust Blockchain Security](https://incrypthos.com/research/formalizing-maximal-extractable-value-for-robust-blockchain-security/)
![A high-fidelity render depicts a sophisticated mechanical assembly, featuring polished silver and translucent blue components, dynamically interacting with a fine, particulate substance. This intricate decentralized ledger technology DLT mechanism symbolizes the internal workings of a blockchain or cryptocurrency protocol. The blue elements could represent validator nodes or smart contract execution environments, while the metallic structures signify core infrastructure. The flowing particulate matter illustrates tokenomics or transaction throughput, undergoing a consensus mechanism or hashing algorithm process. It visually conveys block propagation and scalability solutions within a distributed network, emphasizing precision in cryptographic primitives.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-mechanism-processing-cryptographic-data-streams.jpeg)

This research establishes a foundational theory for Maximal Extractable Value, enabling rigorous security proofs and clearer distinction between beneficial and exploitative value extraction in decentralized systems.

**Tags:** [Account](https://incrypthos.com/news/account/), [Account Compromise](https://incrypthos.com/news/account-compromise/), [Asset Drain](https://incrypthos.com/news/asset-drain/), [Asset Protection](https://incrypthos.com/news/asset-protection/), [Compromise](https://incrypthos.com/news/compromise/), [Contract](https://incrypthos.com/news/contract/), [Cybercrime](https://incrypthos.com/news/cybercrime/), [Decentralized Finance](https://incrypthos.com/news/decentralized-finance/), [DeFi](https://incrypthos.com/news/defi/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Emergency Governance](https://incrypthos.com/news/emergency-governance/), [Emergency Response](https://incrypthos.com/news/emergency-response/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance](https://incrypthos.com/news/governance/), [Governance Vote](https://incrypthos.com/news/governance-vote/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Phishing](https://incrypthos.com/news/phishing/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol](https://incrypthos.com/news/protocol/), [Protocol Safeguard](https://incrypthos.com/news/protocol-safeguard/), [Protocol Security](https://incrypthos.com/news/protocol-security/), [Recovery](https://incrypthos.com/news/recovery/), [Security](https://incrypthos.com/news/security/), [User Education](https://incrypthos.com/news/user-education/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol Recovers $13.5 Million from Lazarus Group Phishing Attack",
            "item": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-from-lazarus-group-phishing-attack/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-from-lazarus-group-phishing-attack/"
    },
    "headline": "Venus Protocol Recovers $13.5 Million from Lazarus Group Phishing Attack \u221e Security",
    "description": "A targeted phishing exploit against a high-value user's delegated account control enabled asset drain, underscoring critical off-chain vulnerability. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-recovers-13-5-million-from-lazarus-group-phishing-attack/",
    "datePublished": "2025-09-17T13:32:24+00:00",
    "dateModified": "2025-09-17T15:50:17+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/decentralized-oracle-node-resiliency-cross-chain-data-stream-recovery.jpeg",
        "caption": "A futuristic, multi-segmented white device with visible internal components and solar panels is partially submerged in turbulent blue water. The water actively splashes around the device, creating numerous bubbles and visible ripples across the surface. This imagery powerfully illustrates a decentralized oracle network DON node operating within a fluid and potentially volatile corporate crypto environment. The robust design and active interaction with the water symbolize the critical need for protocol resilience and network node redundancy in maintaining continuous data provenance for smart contract applications. It highlights the complex mechanisms required for cross-chain interoperability, where off-chain computation reliably feeds on-chain systems. The dynamic water represents liquidity pool dynamics and the constant flow of information, underscoring the challenges and solutions in ensuring asset recovery mechanisms and seamless tokenized asset transfers across diverse distributed ledger technology DLT ecosystems. This visual narrative emphasizes the continuous validation and secure data transmission fundamental to modern blockchain infrastructure."
    },
    "keywords": [
        "Account",
        "Account Compromise",
        "Asset Drain",
        "Asset Protection",
        "Compromise",
        "Contract",
        "Cybercrime",
        "Decentralized Finance",
        "DeFi",
        "DeFi Security",
        "Delegated Control",
        "Emergency Governance",
        "Emergency Response",
        "Fund Recovery",
        "Governance",
        "Governance Vote",
        "Lazarus Group",
        "Phishing",
        "Phishing Attack",
        "Protocol",
        "Protocol Safeguard",
        "Protocol Security",
        "Recovery",
        "Security",
        "User Education"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-recovers-13-5-million-from-lazarus-group-phishing-attack/
