# Venus Protocol User Compromised by Phishing, $13.5m Funds Recovered ∞ Security

**Published:** 2025-09-17
**Categories:** Security

---

![A close-up view reveals the complex internal workings of a watch, featuring polished metallic gears, springs, and a prominent red-centered balance wheel. Overlapping these traditional horological mechanisms is a striking blue, semi-circular component etched with intricate circuit board patterns](https://incrypthos.com/wp-content/uploads/2025/09/hybrid-mechanical-digital-ledger-technology-protocol-interoperability.jpeg)

![A large, faceted blue crystalline structure, reminiscent of a massive immutable ledger shard, forms the central focus, with a luminous full moon embedded within its depths. White snow or frost accents the crystal's contours, suggesting cold storage for digital assets](https://incrypthos.com/wp-content/uploads/2025/09/immutable-ledger-shard-oracle-protocol-architecture-digital-asset.jpeg)

## Briefing

The Venus Protocol, a prominent DeFi lending platform, recently experienced a targeted phishing attack by the Lazarus Group that compromised a major user’s [delegated account control](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/). This incident, occurring on September 2, 2025, resulted in the theft of $13.5 million in various digital assets, underscoring the persistent threat of social engineering against high-value targets within the decentralized ecosystem. Crucially, the protocol’s emergency governance mechanism facilitated the unprecedented recovery of the entire $13.5 million within 12 hours, setting a new benchmark for rapid incident response in DeFi.

![The image displays a partially opened spherical object, revealing an inner core and surrounding elements. Its outer shell is white and segmented, fractured to expose a vibrant blue granular substance mixed with clear, cubic crystals](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-protocol-core-encapsulating-encrypted-data-and-secure-key-mechanism.jpeg)

## Context

Prior to this event, the DeFi landscape has consistently faced a spectrum of vulnerabilities, often rooted in smart contract exploits or private key compromises. However, this incident pivots to an off-chain vector ∞ the human element. The prevailing attack surface for such exploits frequently involves sophisticated [social engineering](https://incrypthos.com/security/thorchain-co-founder-wallet-compromised-via-social-engineering/) tactics designed to circumvent robust on-chain security, leveraging a user’s trust or operational oversight rather than a direct protocol flaw.

![A translucent blue device with a smooth, rounded form factor is depicted against a light grey background. Two clear, rounded protrusions, possibly interactive buttons, and a dark rectangular insert are visible on its surface](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-identity-hardware-wallet-cryptographic-primitive.jpeg)

## Analysis

The incident’s technical mechanics involved a phishing scam that deployed a malicious Zoom client to compromise a major Venus Protocol user, Kuan Sun. This enabled the Lazarus Group to gain [delegated control](https://incrypthos.com/news/delegated-control/) over the user’s account, allowing them to initiate unauthorized borrowing and asset redemption. The attack bypassed the protocol’s core smart contract logic and front-end interfaces, which remained uncompromised, by exploiting the permissions granted to a compromised user account. This chain of cause and effect highlights how an off-chain compromise of a user’s operational environment can directly impact on-chain asset security through delegated authority.

![A close-up view reveals a complex metallic device partially encased in striking blue, ice-like crystalline structures, with a central square component suggesting a specialized chip. Wires and other mechanical elements are visible, indicating an intricate technological assembly](https://incrypthos.com/wp-content/uploads/2025/09/cryogenic-cooling-module-for-high-performance-blockchain-validation-hardware.jpeg)

## Parameters

- **Protocol Targeted** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **Attack Vector** ∞ Phishing via Malicious Zoom Client leading to [Delegated Account](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) Control

- **Threat Actor** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/)

- **Initial Financial Impact** ∞ $13.5 Million

- **Funds Recovered** ∞ $13.5 Million

- **Recovery Method** ∞ [Emergency Governance](https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/) Vote and Forced Liquidation

- **Incident Date** ∞ September 2, 2025

- **Resolution Time** ∞ Less than 12 hours

![A futuristic, metallic device with a modular design, primarily in blue and silver tones, is depicted resting on a textured, sandy surface. A translucent, spherical object with a crystalline interior is centrally mounted on its top surface](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-architecture-safeguarding-digital-asset-custody.jpeg)

## Outlook

Immediate mitigation for users requires heightened vigilance against social engineering, rigorous software verification, and the adoption of hardware security modules for critical accounts. For protocols, this incident underscores the necessity of robust off-chain security awareness campaigns and the potential for integrating emergency [governance](https://incrypthos.com/news/governance/) mechanisms for rapid response. This event will likely catalyze new security best practices focusing on the perimeter defense of user operational environments and the development of more resilient delegated permission systems to contain the blast radius of such compromises.

![A futuristic metallic apparatus, resembling a high-performance blockchain node, is enveloped by a dense, light-blue particulate cloud. Transparent conduits connect segments of the device, hinting at internal mechanisms and data flow](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-engine-processing-decentralized-network-transactions.jpeg)

## Verdict

**This incident decisively reaffirms that the human element remains a critical attack surface, necessitating a holistic security posture that extends beyond [smart contract](https://incrypthos.com/research/llms-automate-smart-contract-formal-verification-property-generation/) audits to encompass comprehensive user and operational security.**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">AInvest</a>

## Glossary

<a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account control 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/security/thorchain-co-founder-wallet-compromised-via-social-engineering/" class="glossary-item-box">

## social engineering 

A sophisticated social engineering campaign led to the compromise of a prominent individual's private key, resulting in a seven-figure asset drain. </a><a href="https://incrypthos.com/news/delegated-control/" class="glossary-item-box">

## delegated control 

Definition ∞ Delegated control refers to a system where the authority to manage or operate certain functions is transferred from one party to another. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/" class="glossary-item-box">

## emergency governance 

Sky Protocol's strategic rebrand and token upgrades enhance capital efficiency and governance accessibility within the stablecoin ecosystem. </a><a href="https://incrypthos.com/news/governance/" class="glossary-item-box">

## governance 

Definition ∞ Governance refers to the systems, processes, and rules by which an entity or system is directed and controlled. </a><a href="https://incrypthos.com/research/llms-automate-smart-contract-formal-verification-property-generation/" class="glossary-item-box">

## smart contract 

This research integrates large language models with formal verification to automatically generate precise properties, fundamentally enhancing smart contract security. </a>

**Tags:** [Compromise](https://incrypthos.com/news/compromise/), [Governance Response](https://incrypthos.com/news/governance-response/), [Account Compromise](https://incrypthos.com/news/account-compromise/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [DeFi](https://incrypthos.com/news/defi/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/)	

## Discover More

- 
### [Polkadot DAO Caps DOT Supply at 2.1 Billion Tokens](https://incrypthos.com/web3/polkadot-dao-caps-dot-supply-at-2-1-billion-tokens/)
![A glowing blue faceted crystal, possibly a digital asset or non-fungible token NFT, emerges from soft white cloud-like textures. This visual metaphor highlights the intrinsic value of a blockchain token. The crystal's luminescence suggests active network participation, perhaps proof-of-stake validation or a genesis block. Surrounding elements could represent data liquidity pools or decentralized autonomous organization DAO governance. The intricate structure signifies cryptographic security and immutable ledger integrity within Web3 infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-asset-visualization-tokenomics-digital-scarcity-representation.jpeg)

Polkadot's governance body enacted a hard cap on DOT supply, establishing scarcity to attract long-term capital and institutional engagement.

- 
### [NPM Supply Chain Compromise Threatens JavaScript Crypto Ecosystem](https://incrypthos.com/security/npm-supply-chain-compromise-threatens-javascript-crypto-ecosystem/)
![A stark, minimalist composition features translucent geometric planes, resembling Layer 2 scaling solutions, partially obscured by granular white material, evocative of crypto winter conditions. A deep blue panel suggests digital asset liquidity pools, with the white powder hinting at cold storage security. The crystalline structures symbolize blockchain transparency and immutable ledger integrity, while the overall aesthetic reflects the precise cryptographic primitives underpinning decentralized finance DeFi. The scene conveys a sense of emerging protocol innovation within a bear market environment, emphasizing data integrity and network security.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-protocol-layers-navigating-digital-asset-frost.jpeg)

A pervasive supply chain attack on NPM accounts injects malicious code, covertly swapping cryptocurrency addresses during user-approved transactions.

- 
### [Game Theory Models MEV, Mitigates Extraction with Mechanism Design](https://incrypthos.com/research/game-theory-models-mev-mitigates-extraction-with-mechanism-design/)
![A large, textured sphere, resembling a celestial body, partially submerges in dark blue liquid, generating dynamic splashes. Smaller white spheres interact with the fluid. This visual metaphorically depicts a decentralized exchange's DEX liquidity pool, where tokenomics drive asset interactions. The main sphere represents a governance token or wrapped asset undergoing smart contract execution, influencing market volatility. The liquid signifies available liquidity, while smaller spheres are other digital assets or stablecoins within the DeFi ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-liquidity-pool-dynamics-tokenomics-smart-contract-execution.jpeg)

This research formalizes Maximal Extractable Value dynamics through a multi-stage game, revealing systemic inefficiencies and quantifying mitigation strategies.

- 
### [Venus Protocol User Phished, $13.5m Recovered via Governance](https://incrypthos.com/security/venus-protocol-user-phished-13-5m-recovered-via-governance/)
![A spherical digital asset, deep blue with swirling white patterns, represents a tokenized asset within a distributed network. It is securely encapsulated by a robust, metallic silver framework, symbolizing cryptographic security and immutable ledger protection. This intricate structure, featuring solid bands and perforated grilles, suggests a sophisticated consensus mechanism safeguarding blockchain data. The design evokes a secure node or an oracle's protected data stream, emphasizing asset custody and smart contract integrity.](https://incrypthos.com/wp-content/uploads/2025/09/immutable-digital-asset-orb-decentralized-ledger-protection.jpeg)

User-level phishing compromising delegated account control remains a critical vector for unauthorized asset manipulation within DeFi protocols.

- 
### [Formalizing Maximal Extractable Value for Blockchain Security Proofs](https://incrypthos.com/research/formalizing-maximal-extractable-value-for-blockchain-security-proofs/)
![A close-up, angled view reveals a sophisticated, modular metallic mechanism featuring a vibrant blue core, intricately layered with white crystalline frost. This apparatus, reminiscent of a hardware security module HSM, underscores the critical role of cold storage in safeguarding digital assets. The visible cryptographic freezing effect symbolizes robust data integrity and immutability essential for blockchain protocol security, preventing unauthorized smart contract execution within a distributed ledger environment. Its design evokes high-performance, secure computational infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/advanced-cryogenic-data-processing-unit-securing-blockchain-protocol-integrity.jpeg)

This research establishes a rigorous, abstract theory of MEV, enabling formal security proofs against economic attacks that exploit transaction ordering.

- 
### [Ethereum EIP-4844 Enhances L2 Scalability and Reduces Transaction Costs](https://incrypthos.com/tech/ethereum-eip-4844-enhances-l2-scalability-and-reduces-transaction-costs/)
![A gleaming, three-dimensional metallic emblem, predominantly silver and deep blue, floats centrally against a blurred, monochromatic background. Its intricate design features layered, interlocking "S" shapes, suggesting complex blockchain architecture and decentralized ledger systems. The polished surfaces reflect light, highlighting its robust cryptographic security and data integrity. This visual metaphorically represents a sophisticated DeFi protocol or Layer 2 scaling solution, emphasizing network consensus and transaction finality. The emblem's structure evokes sharding or sidechain mechanisms, crucial for scalability and efficient digital asset management within a Web3 infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/smart-contract-layer-2-scaling-solution-tokenomics-visual.jpeg)

EIP-4844 fundamentally rearchitects data availability, enabling cost-efficient L2 operations and positioning Ethereum as a robust global settlement layer.

- 
### [Venus Protocol User Phished, $13.5 Million Recovered by Governance](https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-recovered-by-governance/)
![A close-up view reveals a sophisticated mechanical assembly, potentially a core component of a validator node. Polished silver and deep blue elements dominate, with a central cylindrical module featuring intricate vents, likely housing a cryptographic primitive for secure operations. Numerous blue conduits interweave, representing data pathways facilitating transaction finality within a distributed ledger technology framework. Peripheral metallic modules suggest integrated hardware security enclaves crucial for maintaining decentralized network integrity and executing proof-of-stake consensus algorithms. The composition emphasizes precision engineering.](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-validator-engine-with-secure-cryptographic-interconnects.jpeg)

A sophisticated phishing attack leveraging a compromised user client granted delegated control, underscoring critical user-side vulnerability in DeFi.

- 
### [Nemo Protocol Suffers $2.6 Million Exploit Due to Unaudi](https://incrypthos.com/security/nemo-protocol-suffers-2-6-million-exploit-due-to-unaudi/)
![A sophisticated, metallic hardware component integrates a vibrant, translucent blue substance. This textured, viscous element likely functions as a high-performance liquid cooling system for a blockchain validator node or mining rig. The metallic housing includes a control interface, suggesting active protocol execution and network management. The blue core could represent a secure enclave for private keys or a data shard holding transactional data. Its luminous quality hints at active hashrate generation or proof-of-stake validation, critical for decentralized ledger technology and cryptographic security. This advanced distributed ledger technology infrastructure supports on-chain governance.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-network-node-liquid-cooling-data-shard-engine.jpeg)

A developer's unauthorized code deployment and flash loan vulnerability led to a $2.6 million loss, exposing critical internal control failures.

- 
### [Ethereum Foundation Establishes Comprehensive Privacy Roadmap for Protocol](https://incrypthos.com/tech/ethereum-foundation-establishes-comprehensive-privacy-roadmap-for-protocol/)
![The image showcases a sophisticated internal mechanism, featuring translucent blue and opaque white components. This intricate design represents a decentralized ledger technology DLT framework, emphasizing blockchain architecture and protocol layers. The transparent blue elements suggest data immutability pathways and transaction processing unit flow, crucial for smart contract execution. Opaque white structures denote distributed network nodes and consensus mechanism components, ensuring cryptographic hashing integrity. This visual metaphor illustrates advanced interoperability solutions within a Web3 infrastructure, highlighting scalability infrastructure for efficient digital asset management.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-architecture-visualizing-protocol-layer-interoperability.jpeg)

This strategic privacy roadmap fundamentally re-architects Ethereum's data handling, enabling robust confidential transactions and secure identity primitives.

**Tags:** [Account Compromise](https://incrypthos.com/news/account-compromise/), [Compromise](https://incrypthos.com/news/compromise/), [DeFi](https://incrypthos.com/news/defi/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance](https://incrypthos.com/news/governance/), [Governance Response](https://incrypthos.com/news/governance-response/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Off-Chain Vulnerability](https://incrypthos.com/news/off-chain-vulnerability/), [Phishing](https://incrypthos.com/news/phishing/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol](https://incrypthos.com/news/protocol/), [Recovery](https://incrypthos.com/news/recovery/), [Security](https://incrypthos.com/news/security/), [Social](https://incrypthos.com/news/social/), [Threat Mitigation](https://incrypthos.com/news/threat-mitigation/), [User Education](https://incrypthos.com/news/user-education/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol User Compromised by Phishing, $13.5m Funds Recovered",
            "item": "https://incrypthos.com/security/venus-protocol-user-compromised-by-phishing-13-5m-funds-recovered/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-user-compromised-by-phishing-13-5m-funds-recovered/"
    },
    "headline": "Venus Protocol User Compromised by Phishing, $13.5m Funds Recovered \u221e Security",
    "description": "A sophisticated phishing attack targeting delegated account control highlights critical off-chain human element vulnerabilities, demanding enhanced user security protocols. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-user-compromised-by-phishing-13-5m-funds-recovered/",
    "datePublished": "2025-09-17T11:49:04+00:00",
    "dateModified": "2025-09-17T11:49:07+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/advanced-liquid-cooled-asic-miner-enclosure-for-hash-rate-optimization.jpeg",
        "caption": "The image presents a detailed close-up of a translucent, frosted enclosure, featuring visible water droplets on its surface and intricate blue internal components. A prominent grey circular button and another control element are embedded, suggesting user interaction or diagnostic functions. This specialized hardware represents a cutting-edge liquid-cooled system designed for high-performance blockchain infrastructure, such as an ASIC miner or a validator node. The advanced thermal management system, evident from the condensation, is critical for maintaining optimal operating temperatures, thereby maximizing hash rate and ensuring energy efficiency in demanding Proof-of-Work or Proof-of-Stake environments. Such robust design supports reliable decentralized computing, facilitating secure transaction processing and contributing to overall DLT scalability. The integrated controls allow for precise operational adjustments, vital for optimizing resource allocation and network participation."
    },
    "keywords": [
        "Account Compromise",
        "Compromise",
        "DeFi",
        "DeFi Security",
        "Delegated Control",
        "Fund Recovery",
        "Governance",
        "Governance Response",
        "Lazarus Group",
        "Off-Chain Vulnerability",
        "Phishing",
        "Phishing Attack",
        "Protocol",
        "Recovery",
        "Security",
        "Social",
        "Threat Mitigation",
        "User Education"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-user-compromised-by-phishing-13-5m-funds-recovered/
