# Venus Protocol User Phished, $13.5 Million Funds Recovered ∞ Security

**Published:** 2025-09-18
**Categories:** Security

---

![A precision-engineered mechanical component, possibly a rotor or gear, is partially enveloped by a dynamic, translucent blue fluid. The fluid exhibits turbulent motion, suggesting high-velocity flow and interaction with the component's intricate structure](https://incrypthos.com/wp-content/uploads/2025/09/optimized-defi-liquidity-flow-enhancing-blockchain-protocol-throughput.jpeg)

![The image presents a close-up of a futuristic device featuring a translucent casing over a dynamic blue internal structure. A central, brushed metallic button is precisely integrated into the surface](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-protocol-governance-mechanism-digital-asset-management.jpeg)

## Briefing

The Venus Protocol, a decentralized finance lending platform, successfully recovered $13.5 million in digital assets following a targeted phishing attack on a major user. This incident, attributed to the North Korea-linked Lazarus Group, exploited [delegated account control](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) through a malicious Zoom client, allowing unauthorized asset borrowing and redemption. The rapid, 12-hour resolution, orchestrated via an emergency governance vote and security partner collaboration, marks a significant precedent for successful fund recovery in DeFi history.

![The image displays a complex, highly detailed mechanical assembly, dominated by a central blue gear-like component with radiating arms and intricate wiring. Sharp focus on the central mechanism highlights its textured spherical nodes and metallic internal structures, while peripheral elements blur into the background](https://incrypthos.com/wp-content/uploads/2025/09/Core-Blockchain-Validator-Node-Engineering-for-Distributed-Consensus-Mechanisms.jpeg)

## Context

Prior to this incident, the DeFi landscape has grappled with persistent social engineering threats and the inherent risks associated with user-side security. While smart contract audits are standard, the prevailing attack surface often includes vulnerabilities at the human interface, where [sophisticated phishing](https://incrypthos.com/security/multi-sig-wallet-drained-by-sophisticated-phishing-contract-attack/) campaigns leverage trust and urgency to compromise user credentials or delegated permissions. This exploit bypassed direct smart contract vulnerabilities, focusing instead on a known class of user-centric risk.

![A close-up view reveals a sophisticated, translucent blue electronic device with a central, raised metallic button. Luminous blue patterns resembling flowing energy or data are visible beneath the transparent surface, extending across the device's length](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-biometric-authentication-for-digital-asset-management.jpeg)

## Analysis

The attack vector did not involve a compromise of Venus Protocol’s core smart contracts or front-end interface. Instead, the Lazarus Group executed a sophisticated phishing scam, leveraging a malicious Zoom client to gain [delegated control](https://incrypthos.com/news/delegated-control/) over a prominent user’s account. This unauthorized access enabled the attackers to borrow and redeem various assets, including stablecoins and wrapped Bitcoin, effectively draining the user’s account. The success of the exploit hinged on the attacker’s ability to manipulate the user into granting permissions that facilitated on-chain asset manipulation, underscoring the critical importance of robust personal security hygiene in the decentralized ecosystem.

![A detailed view presents a complex, cubic technological device featuring intricate blue and black components, surrounded by interconnected cables. The central element on top is a blue circular dial with a distinct logo, suggesting a high-level control or identification mechanism](https://incrypthos.com/wp-content/uploads/2025/09/advanced-blockchain-node-hardware-wallet-cryptographic-security-module.jpeg)

## Parameters

- **Protocol Targeted** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **[Attack Vector](https://incrypthos.com/security/multi-sig-wallet-drained-by-sophisticated-phishing-contract-attack/)** ∞ Phishing Scam (Malicious Zoom Client)

- **Attacker Group** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/)

- **Financial Impact** ∞ $13.5 Million (fully recovered)

- **Incident Date** ∞ September 2, 2025

- **[Recovery](https://incrypthos.com/news/recovery/) Timeline** ∞ Less than 12 hours

- **Recovery Mechanism** ∞ [Emergency Governance](https://incrypthos.com/news/emergency-governance/) Vote & Forced Liquidation

- **Affected Component** ∞ User [Delegated Account](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) Control

![A close-up reveals a sophisticated, metallic device featuring a translucent blue screen displaying intricate digital patterns and alphanumeric characters. A prominent silver frame with a central button accents the front, suggesting an interactive interface for user input and transaction confirmation](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-cryptographic-module-digital-asset-management.jpeg)

## Outlook

This incident reinforces the imperative for enhanced user education on social engineering tactics and the critical review of [delegated permissions](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) within DeFi. Protocols may consider implementing stricter multi-factor authentication for high-value actions or introducing time-locks on delegated controls to mitigate similar risks. The successful, rapid recovery through decentralized governance sets a new benchmark for incident response, potentially influencing future security best practices and highlighting the evolving balance between decentralization and necessary emergency intervention capabilities across the ecosystem.

![A futuristic, metallic device with a modular design, primarily in blue and silver tones, is depicted resting on a textured, sandy surface. A translucent, spherical object with a crystalline interior is centrally mounted on its top surface](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-architecture-safeguarding-digital-asset-custody.jpeg)

## Verdict

**The Venus Protocol’s successful recovery from a Lazarus Group [phishing attack](https://incrypthos.com/news/phishing-attack/) demonstrates the critical role of robust governance and rapid response in mitigating user-side vulnerabilities within the DeFi landscape.**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">ainvest.com</a>

## Glossary

<a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account control 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/security/multi-sig-wallet-drained-by-sophisticated-phishing-contract-attack/" class="glossary-item-box">

## sophisticated phishing 

Attackers deployed a deceptive Etherscan-verified contract, leveraging the Safe Multi Send mechanism to bypass user scrutiny and drain over $3 million. </a><a href="https://incrypthos.com/news/delegated-control/" class="glossary-item-box">

## delegated control 

Definition ∞ Delegated control refers to a system where the authority to manage or operate certain functions is transferred from one party to another. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/security/multi-sig-wallet-drained-by-sophisticated-phishing-contract-attack/" class="glossary-item-box">

## attack vector 

Attackers deployed a deceptive Etherscan-verified contract, leveraging the Safe Multi Send mechanism to bypass user scrutiny and drain over $3 million. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/news/recovery/" class="glossary-item-box">

## recovery 

Definition ∞ Recovery, in a financial context, signifies the process by which an asset, market, or economy regains value after a period of decline. </a><a href="https://incrypthos.com/news/emergency-governance/" class="glossary-item-box">

## emergency governance 

Definition ∞ Emergency governance refers to pre-defined protocols or mechanisms that allow for rapid decision-making and action in critical situations within a decentralized system. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated permissions 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/news/phishing-attack/" class="glossary-item-box">

## phishing attack 

Definition ∞ A phishing attack is a fraudulent attempt to obtain sensitive information, such as usernames, passwords, and financial details, by disguising oneself as a trustworthy entity in electronic communication. </a>

**Tags:** [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Emergency Governance](https://incrypthos.com/news/emergency-governance/), [Digital Assets](https://incrypthos.com/news/digital-assets/), [Governance Vote](https://incrypthos.com/news/governance-vote/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Assets](https://incrypthos.com/news/assets/)	

## Discover More

- 
### [Chainlink, UBS, DigiFT Automate Tokenized Fund Operations](https://incrypthos.com/adoption/chainlink-ubs-digift-automate-tokenized-fund-operations/)
![A close-up view reveals a sophisticated, frost-laden cooling mechanism, central to mining farm infrastructure. Its metallic hub and translucent blue blades are coated with snow, indicative of extreme thermal management. This cryogenic cooling unit is crucial for optimal ASIC efficiency, preventing thermal throttling in high-performance Proof-of-Work PoW operations. Such advanced hardware ensures hash rate optimization, contributing to sustainable blockchain operations by reducing energy consumption and enhancing hardware longevity for block validation within decentralized networks.](https://incrypthos.com/wp-content/uploads/2025/09/cryogenic-cooling-unit-optimizing-asic-mining-hash-rate-efficiency.jpeg)

Automating tokenized fund lifecycles on-chain drives efficiency, reducing manual errors and enhancing transparency for institutional asset management.

- 
### [Formalizing MEV: Foundations for Secure Blockchain Mechanism Design](https://incrypthos.com/research/formalizing-mev-foundations-for-secure-blockchain-mechanism-design/)
![A sleek, translucent blue hardware device features a prominent metallic authentication button, suggesting robust digital asset security. Intricate, luminous blue patterns flow within the device's chassis, visually representing real-time blockchain data propagation and transaction validation. This secure enclave likely facilitates private key management and multi-signature approvals for decentralized finance DeFi protocols. Its design emphasizes tamper-evident cold storage, crucial for safeguarding cryptocurrency holdings and enabling secure dApp interactions. The interface could support biometric authentication for enhanced user access control.](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-biometric-authentication-for-digital-asset-management.jpeg)

This research formalizes Maximal Extractable Value, providing a rigorous framework for understanding and mitigating systemic blockchain vulnerabilities.

- 
### [Ethereum Price Climbs above $4,600](https://incrypthos.com/markets/ethereum-price-climbs-above-4600/)
![A precise, metallic, interlocking mechanism, an abstract cryptographic key or smart contract, rests upon an undulating granular surface. This textured substrate, composed of countless tiny spheres, visually represents distributed ledger technology DLT or Web3 infrastructure comprising network nodes or data packets. The metallic construct's sharp geometry signifies the robust engineering of a DeFi primitive or consensus mechanism, embodying intricate tokenomics and secure operational logic within a decentralized ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/Decentralized-Finance-Primitive-on-Granular-Network-Substrate.jpeg)

Ethereum's price has risen, crossing the $4,600 mark with a notable daily increase, signaling renewed investor interest.

- 
### [Ethereum Spot ETF Sees Notable Outflow](https://incrypthos.com/markets/ethereum-spot-etf-sees-notable-outflow/)
![A modern office environment partially submerged in water and ethereal clouds, symbolizing a transformative shift. Prominently, concentric, translucent blue rings emerge from the liquid, suggesting intricate blockchain network architecture or DeFi protocol layers. These rings represent scalability solutions like Layer 2 rollups or the interconnectedness of dApps within a Web3 ecosystem. The surrounding mist and water denote market liquidity dynamics and volatile sentiment, impacting digital asset valuations. This visual metaphor encapsulates the complex interplay of on-chain governance and protocol composability in a rapidly evolving decentralized finance landscape.](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-network-composability-layers-amidst-decentralized-liquidity.jpeg)

A recent $1.9 million outflow from U.S. Ethereum spot ETFs signals shifting investor sentiment and ongoing market fluctuations.

- 
### [Boundless Mainnet Launches, Pioneering Verifiable Compute for Internet-Scale Blockchains](https://incrypthos.com/web3/boundless-mainnet-launches-pioneering-verifiable-compute-for-internet-scale-blockchains/)
![A sophisticated white and blue modular electronic component, prominently featuring an Application-Specific Integrated Circuit ASIC with a distinct blue frame, integrates into a larger system. This specialized hardware suggests a critical role in decentralized physical infrastructure networks DePIN. Its precise engineering implies robust computational integrity, essential for validator nodes and high-throughput transaction processing within a distributed ledger technology DLT framework. The modular design supports scalable network architecture and efficient smart contract execution, underpinning secure multi-party computation MPC and cryptographic primitives for Web3 functionality.](https://incrypthos.com/wp-content/uploads/2025/09/modular-asic-node-facilitating-decentralized-ledger-transaction-integrity.jpeg)

Boundless activates its mainnet, introducing Proof of Verifiable Work to redefine blockchain scalability by incentivizing verifiable computation, fostering a new primitive for cross-chain application development.

- 
### [Multi-Sig Wallet Drained by Sophisticated Phishing Attack](https://incrypthos.com/security/multi-sig-wallet-drained-by-sophisticated-phishing-attack/)
![A close-up reveals a prominent metallic button embedded within a translucent blue casing, showcasing internal components. This sophisticated hardware wallet facilitates secure transaction signing and private key management. It functions as a secure element for cold storage of digital assets, offering robust blockchain security. The device's design suggests a Web3 interface for decentralized finance DeFi interactions, potentially supporting multi-signature approvals and cryptographic proof mechanisms for enhanced user control and asset protection.](https://incrypthos.com/wp-content/uploads/2025/09/hardware-wallet-secure-enclave-cryptographic-key-digital-asset-interface.jpeg)

A cunning phishing attack exploited a multi-signature wallet, leading to the unauthorized transfer of assets by disguising malicious approvals.

- 
### [SEC Approves Grayscale Fund and Bitcoin ETF Options](https://incrypthos.com/markets/sec-approves-grayscale-fund-and-bitcoin-etf-options/)
![A close-up view reveals a frosted, translucent, irregularly shaped object adorned with numerous water droplets, symbolizing blockchain transparency and data integrity. Behind this cryptographic primitive, blurred deep blue and lighter blue forms suggest intricate protocol architecture and underlying digital asset flows. A smooth, dark grey, curved metallic element on the left signifies robust hardware wallet security or institutional custody solutions. The droplets emphasize network resilience and transaction finality, reflecting a secure distributed ledger technology DLT environment. This visual metaphor highlights the immutability inherent in Web3 infrastructure.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-protocol-architecture-visualizing-decentralized-ledger-security.jpeg)

The SEC's recent approvals open new, regulated avenues for institutional investors to access the crypto market, signaling growing legitimacy.

- 
### [Multi-Sig Wallet Drained via Sophisticated Disguised Approval Phishing](https://incrypthos.com/security/multi-sig-wallet-drained-via-sophisticated-disguised-approval-phishing/)
![A highly magnified perspective reveals a textured, light blue surface forming a deep, circular void, reminiscent of a liquidity pool within a decentralized exchange DEX. Suspended precisely above this smart contract-governed depression is a luminous, moon-like digital asset, its surface detailed with tokenomics-driven features. This visual metaphor suggests a blockchain token experiencing significant price action, potentially mooning within a Web3 ecosystem. The intricate surface texture could represent the underlying network protocol or distributed ledger technology DLT, emphasizing the complex governance token dynamics and yield farming opportunities inherent in DeFi operations.](https://incrypthos.com/wp-content/uploads/2025/09/digital-asset-mooning-over-decentralized-exchange-liquidity-pool.jpeg)

A sophisticated phishing attack leveraging a fake contract and disguised approvals compromised a multi-signature wallet, resulting in over $3 million in direct asset loss.

- 
### [Solana’s On-Chain Strength Signals Major Capital Shift from Ethereum](https://incrypthos.com/insights/solanas-on-chain-strength-signals-major-capital-shift-from-ethereum/)
![A visual metaphor for a robust blockchain ecosystem presents a central, irregularly shaped digital asset or DAO core. Its crystalline white upper half suggests immutability and cold storage, while the deep blue lower half represents liquidity pools and data integrity. Translucent, concentric rings orbit the core, symbolizing Layer-2 scaling solutions, smart contracts, and governance protocols within a Web3 architecture. Scattered white granular material on the reflective surface evokes micro-transactions or token fragmentation. Reflective pillars in the background underscore network infrastructure and DLT.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ecosystem-visualizing-layered-protocols-and-digital-asset-immutability.jpeg)

On-chain data reveals a significant investor shift from Ethereum to Solana, driven by Solana's lower fees and increasing network activity.

**Tags:** [Account](https://incrypthos.com/news/account/), [Assets](https://incrypthos.com/news/assets/), [Decentralized](https://incrypthos.com/news/decentralized/), [DeFi](https://incrypthos.com/news/defi/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Digital Assets](https://incrypthos.com/news/digital-assets/), [Emergency Governance](https://incrypthos.com/news/emergency-governance/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance](https://incrypthos.com/news/governance/), [Governance Vote](https://incrypthos.com/news/governance-vote/), [Incident Response](https://incrypthos.com/news/incident-response/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Phishing](https://incrypthos.com/news/phishing/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol](https://incrypthos.com/news/protocol/), [Protocol Resilience](https://incrypthos.com/news/protocol-resilience/), [Recovery](https://incrypthos.com/news/recovery/), [Security](https://incrypthos.com/news/security/), [Social](https://incrypthos.com/news/social/), [Social Engineering](https://incrypthos.com/news/social-engineering/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol User Phished, $13.5 Million Funds Recovered",
            "item": "https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-funds-recovered/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-funds-recovered/"
    },
    "headline": "Venus Protocol User Phished, $13.5 Million Funds Recovered \u221e Security",
    "description": "A sophisticated phishing attack targeting a high-value user's delegated account control highlights persistent social engineering risks within DeFi. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-funds-recovered/",
    "datePublished": "2025-09-18T10:55:05+00:00",
    "dateModified": "2025-09-18T10:55:07+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Advanced-Protocol-Mechanisms-Powering-Distributed-Ledger-Tokenomics-Infrastructure.jpeg",
        "caption": "The image features a sophisticated mechanical assembly composed of blue and silver gears, shafts, and rings, intricately intertwined. White granular particles are scattered around and within these components, while a transparent, syringe-like element extends from the left. This visual metaphor powerfully illustrates the intricate workings of a decentralized ledger technology DLT network, where advanced consensus mechanisms like Proof of Stake or Delegated Proof of Stake facilitate secure transaction validation and block production. The complex interplay of metallic and transparent components signifies a robust blockchain architecture and efficient smart contract execution within a virtual machine environment. The white particles represent distributed data packets, individual token shards, or liquidity pool contributions, highlighting the dynamic nature of on-chain governance and intricate tokenomics models. The transparent syringe element further suggests precise token distribution events, protocol deployment, or the injection of new digital assets into a Web3 ecosystem, emphasizing controlled and automated processes inherent in cryptographic primitives that underpin modern corporate crypto solutions and institutional DeFi infrastructure."
    },
    "keywords": [
        "Account",
        "Assets",
        "Decentralized",
        "DeFi",
        "DeFi Security",
        "Delegated Control",
        "Digital Assets",
        "Emergency Governance",
        "Fund Recovery",
        "Governance",
        "Governance Vote",
        "Incident Response",
        "Lazarus Group",
        "Phishing",
        "Phishing Attack",
        "Protocol",
        "Protocol Resilience",
        "Recovery",
        "Security",
        "Social",
        "Social Engineering"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-funds-recovered/
