# Venus Protocol User Phished, Funds Recovered by Governance Action ∞ Security

**Published:** 2025-09-17
**Categories:** Security

---

![The image displays a futuristic, abstract composition of translucent blue cubes, reflective metallic surfaces, and soft white cloud-like elements. A prominent metallic pipe extends horizontally through the structure, connecting various parts, with a textured white sphere positioned above](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-architecture-visualizing-blockchain-network-nodes-and-cloud-infrastructure.jpeg)

![The image showcases a highly detailed, close-up view of a complex mechanical and electronic assembly. Central to the composition is a prominent silver cylindrical component, surrounded by smaller metallic modules and interwoven with vibrant blue cables or conduits](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-validator-engine-with-secure-cryptographic-interconnects.jpeg)

## Briefing

The Venus Protocol, a prominent decentralized finance lending platform, recently experienced a sophisticated phishing attack attributed to the North Korea-linked Lazarus Group, resulting in the theft of $13.5 million from a major user’s account. This incident, occurring on September 2, 2025, leveraged a malicious Zoom client to gain delegated control over the user’s assets, enabling the attackers to drain stablecoins and wrapped Bitcoin. Notably, Venus Protocol’s security partners and [emergency governance](https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/) mechanisms facilitated the full recovery of the stolen funds within 12 hours, marking a significant precedent in DeFi security and response.

![A tubular structure, formed by translucent blue rectangular segments, extends into the distance, creating a central void. This core is partially enveloped and surrounded by a dynamic, frothy white substance, resembling intricate frost or cloud-like formations](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-architecture-with-frosted-consensus-mechanism.jpeg)

## Context

Prior to this incident, the DeFi landscape has consistently faced threats from sophisticated actors like the Lazarus Group, known for exploiting various attack surfaces, including social engineering and supply chain vulnerabilities. While smart contract audits often focus on on-chain logic, this exploit underscores the persistent risk posed by off-chain user compromise, where [delegated access](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) or private keys become targets. The prevailing attack surface extends beyond contract code to encompass the broader operational security of high-value users and critical infrastructure.

![The image displays a highly detailed, futuristic hardware module, characterized by its sharp angles, polished dark blue and white surfaces, and metallic highlights. A central, luminous cyan component emits a bright glow, indicating active processing](https://incrypthos.com/wp-content/uploads/2025/09/modular-dlt-component-zero-knowledge-proof-accelerator.jpeg)

## Analysis

The attack’s technical mechanics involved a targeted phishing scam that compromised a major user, Kuan Sun, through a malicious Zoom client. This allowed the Lazarus Group to gain [delegated control](https://incrypthos.com/news/delegated-control/) of the user’s account, circumventing direct smart contract vulnerabilities, as audits confirmed the platform’s core contracts and front end remained uncompromised. The attackers exploited this delegated access to borrow and redeem assets on the victim’s behalf, effectively draining various cryptocurrencies. The success of the attack hinged on the compromise of user-side credentials and permissions, rather than a flaw in the protocol’s underlying smart contract logic.

![A metallic, cubic device with transparent blue accents and a white spherical component is partially submerged in a reflective, rippled liquid, while a vibrant blue, textured, frosty substance envelops one side. The object appears to be a sophisticated hardware wallet, designed for ultimate digital asset custody through advanced cold storage mechanisms](https://incrypthos.com/wp-content/uploads/2025/09/secure-enclave-cold-storage-hardware-wallet-digital-asset-custody.jpeg)

## Parameters

- **Protocol Targeted** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **Attack Vector** ∞ [Phishing](https://incrypthos.com/news/phishing/) via malicious Zoom client leading to delegated account control

- **Attacker Group** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/) (North Korea-linked)

- **Financial Impact** ∞ $13.5 Million (stolen and fully recovered)

- **Resolution Time** ∞ Under 12 hours

- **Recovery Method** ∞ Emergency [governance](https://incrypthos.com/news/governance/) vote and forced liquidation

![A detailed, close-up perspective reveals a complex mechanical and digital apparatus. At its core, a prominent circular component features the distinct Ethereum logo, surrounded by intricate blue circuitry and metallic gears](https://incrypthos.com/wp-content/uploads/2025/09/ethereum-blockchain-protocol-architecture-powering-decentralized-ledger-mechanisms.jpeg)

## Outlook

Immediate mitigation for users involves heightened vigilance against phishing attempts and rigorous security practices for all applications interacting with delegated DeFi permissions. This incident will likely drive a re-evaluation of security best practices, emphasizing the need for multi-factor authentication, hardware wallets, and robust off-chain security audits for high-value accounts. The successful governance-led recovery sets a precedent for [protocol resilience](https://incrypthos.com/news/protocol-resilience/), potentially influencing future emergency response frameworks across similar DeFi platforms to counter sophisticated, non-smart-contract-based exploits.

![Angular, reflective metallic structures resembling advanced computing hardware interlock with vibrant blue crystalline formations encrusted with a white, frosty substance. A luminous, textured sphere, evocative of a moon, floats centrally amidst these elements](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-hardware-cryptographic-hashing-digital-asset-oracle-protocol.jpeg)

## Verdict

**This incident decisively highlights that the weakest link in [DeFi security](https://incrypthos.com/news/defi-security/) often resides not within audited smart contracts, but in the perimeter defenses of individual users and their delegated permissions, demanding a holistic security posture that extends beyond on-chain integrity.**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">AInvest</a>

## Glossary

<a href="https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/" class="glossary-item-box">

## emergency governance 

Sky Protocol's strategic rebrand and token upgrades enhance capital efficiency and governance accessibility within the stablecoin ecosystem. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated access 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/news/delegated-control/" class="glossary-item-box">

## delegated control 

Definition ∞ Delegated control refers to a system where the authority to manage or operate certain functions is transferred from one party to another. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/news/phishing/" class="glossary-item-box">

## phishing 

Definition ∞ Phishing, in the digital asset space, involves deceptive practices aimed at tricking individuals into divulging sensitive information, such as private keys or login credentials, typically through fraudulent communications. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/news/governance/" class="glossary-item-box">

## governance 

Definition ∞ Governance refers to the systems, processes, and rules by which an entity or system is directed and controlled. </a><a href="https://incrypthos.com/news/protocol-resilience/" class="glossary-item-box">

## protocol resilience 

Definition ∞ Protocol resilience describes the ability of a decentralized protocol to maintain its functionality and integrity despite encountering disruptions or adverse conditions. </a><a href="https://incrypthos.com/news/defi-security/" class="glossary-item-box">

## defi security 

Definition ∞ DeFi security pertains to the measures and practices employed to safeguard decentralized finance applications and user assets from threats. </a>

**Tags:** [Delegated Control](https://incrypthos.com/news/delegated-control/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol Resilience](https://incrypthos.com/news/protocol-resilience/), [Account Compromise](https://incrypthos.com/news/account-compromise/), [Governance Action](https://incrypthos.com/news/governance-action/), [User Education](https://incrypthos.com/news/user-education/)	

## Discover More

- 
### [Solana Consensus and Block Capacity Upgrades Enhance Network Performance](https://incrypthos.com/tech/solana-consensus-and-block-capacity-upgrades-enhance-network-performance/)
![A close-up reveals a sophisticated mechanical assembly, featuring interlocking blue and silver metallic components. Intricate wiring, predominantly blue and black, connects various panels, suggesting a complex internal structure. This robust design visually embodies a decentralized autonomous organization DAO's core node infrastructure, highlighting its cryptographic primitive strength. The precision engineering reflects a validator network's integrity, crucial for transaction finality and data integrity within a distributed ledger technology DLT framework. It symbolizes a secure consensus mechanism supporting Web3 infrastructure and on-chain governance.](https://incrypthos.com/wp-content/uploads/2025/09/robust-decentralized-ledger-node-cryptographic-security-protocol-design.jpeg)

Architectural optimizations in Solana's consensus and block processing unlock sub-second finality and elevated transaction throughput, fortifying its high-performance ledger.

- 
### [Venus Protocol Recovers $13.5 Million after Lazarus Phishing Attack](https://incrypthos.com/security/venus-protocol-recovers-13-5-million-after-lazarus-phishing-attack/)
![A sleek, metallic hardware wallet or secure element displays glowing blue digital data, representing cryptographic operations. The device features a prominent U-shaped frame with an integrated button, suggesting biometric authentication or transaction confirmation. Its robust design implies tamper-proof cold storage for private keys and seed phrases, essential for decentralized ledger security. This advanced module facilitates secure digital asset management and immutable record keeping, crucial for blockchain integrity and distributed consensus.](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-cryptographic-module-digital-asset-management.jpeg)

A sophisticated phishing exploit targeting user credentials, not smart contracts, enabled asset drain, highlighting critical human-element vulnerabilities in DeFi security.

- 
### [THORChain Co-Founder Wallet Compromised via Social Engineering](https://incrypthos.com/security/thorchain-co-founder-wallet-compromised-via-social-engineering/)
![A sleek, translucent blue hardware wallet device rests on a dark grey surface. Its modular, clear blue-tinted casing suggests a secure element for cryptographic key storage. A prominent raised section on the left likely functions as a secure input for seed phrase entry or multi-signature confirmation. On the right, a black knob with a white top controls firmware updates or device settings. This tamper-proof unit is engineered for cold storage, facilitating offline transaction signing and safeguarding digital assets within a distributed ledger technology ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/secure-element-hardware-wallet-for-decentralized-private-key-management.jpeg)

A sophisticated social engineering campaign led to the compromise of a prominent individual's private key, resulting in a seven-figure asset drain.

- 
### [Nemo Protocol Suffers $2.6 Million Exploit from Unaudited Code](https://incrypthos.com/security/nemo-protocol-suffers-2-6-million-exploit-from-unaudited-code/)
![White, modular, metallic components connect in a chain-like fashion, forming a futuristic processing unit. Vibrant blue liquid or energy vigorously flows and splashes within an open central segment, propelled by internal mechanisms. This represents a high-performance distributed ledger technology DLT system, where transaction throughput is optimized. The dynamic blue flow symbolizes liquidity pools and on-chain data streams being processed by validator nodes within a modular blockchain architecture. It highlights efficient smart contract execution and cross-chain interoperability, essential for robust DeFi protocols and scalable Web3 infrastructure, underpinned by secure cryptographic primitives across a decentralized network.](https://incrypthos.com/wp-content/uploads/2025/09/modular-protocol-engine-executing-high-velocity-liquidity-pool-transactions.jpeg)

A publicly exposed flash loan function and state-modifying query vulnerability allowed unauthorized asset drainage, posing a critical risk to protocol integrity.

- 
### [SwissBorg Partner API Exploited for $41 Million Solana Token Theft](https://incrypthos.com/security/swissborg-partner-api-exploited-for-41-million-solana-token-theft/)
![Blue faceted crystals, resembling intricate ice formations, are partially covered in white, powdery frost. This visual metaphor illustrates the complex blockchain architecture, where each facet represents a validated block containing immutable records. The frost signifies robust cryptographic security layers protecting digital assets in cold storage. The formation's resilience reflects robust consensus mechanisms ensuring transaction finality and data integrity across a distributed ledger technology network. This imagery evokes the secure, yet complex, nature of decentralized finance protocols and asset tokenization.](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-architecture-cryptographic-security-digital-asset-cold-storage.jpeg)

An external partner API compromise facilitated unauthorized access to SwissBorg's earnings program, resulting in significant asset exfiltration.

- 
### [Ethereum Foundation Advances Privacy with New Protocol Roadmap](https://incrypthos.com/tech/ethereum-foundation-advances-privacy-with-new-protocol-roadmap/)
![A sophisticated transparent cryptographic module showcases internal blue-lit components, emphasizing secure enclave technology for digital asset custody. This advanced hardware wallet design features a prominent '8' button, suggesting multi-signature capabilities or sequential authentication. The visible internal architecture, possibly utilizing liquid cooling, highlights robust private key management and data integrity crucial for decentralized finance infrastructure. This device embodies a next-generation approach to blockchain security, ensuring immutable ledger protection and transaction finality for tokenized assets.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-cryptographic-module-secure-enclave-for-digital-asset-custody.jpeg)

The Ethereum Foundation's privacy roadmap redefines on-chain confidentiality, integrating advanced cryptographic primitives to secure transaction metadata and user interactions across the protocol stack.

- 
### [Venus Protocol User Phished, $13.5 Million Recovered by Governance](https://incrypthos.com/security/venus-protocol-user-phished-13-5-million-recovered-by-governance/)
![A close-up view reveals a sophisticated mechanical assembly, potentially a core component of a validator node. Polished silver and deep blue elements dominate, with a central cylindrical module featuring intricate vents, likely housing a cryptographic primitive for secure operations. Numerous blue conduits interweave, representing data pathways facilitating transaction finality within a distributed ledger technology framework. Peripheral metallic modules suggest integrated hardware security enclaves crucial for maintaining decentralized network integrity and executing proof-of-stake consensus algorithms. The composition emphasizes precision engineering.](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-validator-engine-with-secure-cryptographic-interconnects.jpeg)

A sophisticated phishing attack leveraging a compromised user client granted delegated control, underscoring critical user-side vulnerability in DeFi.

- 
### [Ethereum Pectra Upgrade Integrates Account Abstraction and Staking Refinements](https://incrypthos.com/tech/ethereum-pectra-upgrade-integrates-account-abstraction-and-staking-refinements/)
![A sophisticated modular hardware unit displays brushed metallic surfaces and translucent blue components, illuminated by internal azure glows. This intricate design suggests a high-performance decentralized processing unit, potentially housing a secure enclave for cryptographic operations. Transparent elements visualize data packet flow, indicative of a Layer 2 scaling solution or cross-chain communication protocol. Its robust architecture supports efficient transaction finality and off-chain computation, critical for advanced smart contract execution environments. The integrated components signify a validator node's core functionality within a distributed ledger technology framework, emphasizing interoperability.](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-hardware-secure-enclave-interoperability-protocol-visualization.jpeg)

The Pectra upgrade advances Ethereum's modular architecture, enhancing user experience through account abstraction and optimizing staking mechanics for network resilience.

- 
### [NPM Supply Chain Compromise Threatens JavaScript Crypto Ecosystem](https://incrypthos.com/security/npm-supply-chain-compromise-threatens-javascript-crypto-ecosystem/)
![A stark, minimalist composition features translucent geometric planes, resembling Layer 2 scaling solutions, partially obscured by granular white material, evocative of crypto winter conditions. A deep blue panel suggests digital asset liquidity pools, with the white powder hinting at cold storage security. The crystalline structures symbolize blockchain transparency and immutable ledger integrity, while the overall aesthetic reflects the precise cryptographic primitives underpinning decentralized finance DeFi. The scene conveys a sense of emerging protocol innovation within a bear market environment, emphasizing data integrity and network security.](https://incrypthos.com/wp-content/uploads/2025/09/transparent-protocol-layers-navigating-digital-asset-frost.jpeg)

A pervasive supply chain attack on NPM accounts injects malicious code, covertly swapping cryptocurrency addresses during user-approved transactions.

**Tags:** [Account Compromise](https://incrypthos.com/news/account-compromise/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance Action](https://incrypthos.com/news/governance-action/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Off-Chain Vulnerability](https://incrypthos.com/news/off-chain-vulnerability/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol Resilience](https://incrypthos.com/news/protocol-resilience/), [User Education](https://incrypthos.com/news/user-education/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol User Phished, Funds Recovered by Governance Action",
            "item": "https://incrypthos.com/security/venus-protocol-user-phished-funds-recovered-by-governance-action/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-user-phished-funds-recovered-by-governance-action/"
    },
    "headline": "Venus Protocol User Phished, Funds Recovered by Governance Action \u221e Security",
    "description": "A targeted phishing attack on a user's delegated account control highlights critical risks associated with off-chain credential compromise in DeFi. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-user-phished-funds-recovered-by-governance-action/",
    "datePublished": "2025-09-17T09:33:31+00:00",
    "dateModified": "2025-09-17T09:33:34+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-validator-engine-with-secure-cryptographic-interconnects.jpeg",
        "caption": "The image showcases a highly detailed, close-up view of a complex mechanical and electronic assembly. Central to the composition is a prominent silver cylindrical component, surrounded by smaller metallic modules and interwoven with vibrant blue cables or conduits. This intricate engineering likely represents the internal architecture of a robust validator node within a decentralized autonomous organization DAO infrastructure. The polished metallic surfaces and precise component placement underscore the reliability required for on-chain governance and transaction processing. The central module, possibly a hardware security module HSM, would be responsible for generating and securing cryptographic keys and executing zero-knowledge proofs. The numerous blue data pathways signify the high-throughput requirements for block propagation and achieving finality in a proof-of-stake or delegated proof-of-stake consensus mechanism. This visual metaphor highlights the blend of advanced hardware and sophisticated smart contract logic essential for maintaining the integrity and performance of a distributed ledger technology ecosystem, ensuring network resilience and secure tokenomics operations."
    },
    "keywords": [
        "Account Compromise",
        "DeFi Security",
        "Delegated Control",
        "Fund Recovery",
        "Governance Action",
        "Lazarus Group",
        "Off-Chain Vulnerability",
        "Phishing Attack",
        "Protocol Resilience",
        "User Education"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-user-phished-funds-recovered-by-governance-action/
