# Venus Protocol User Phished, Lazarus Group Recovers $13.5 Million ∞ Security

**Published:** 2025-09-17
**Categories:** Security

---

![A detailed close-up showcases a high-tech, modular hardware device, predominantly in silver-grey and vibrant blue. The right side prominently features a multi-ringed lens or sensor array, while the left reveals intricate mechanical components and a translucent blue element](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-oracle-node-data-stream-hardware-security-module.jpeg)

![A large, faceted blue crystalline structure, reminiscent of a massive immutable ledger shard, forms the central focus, with a luminous full moon embedded within its depths. White snow or frost accents the crystal's contours, suggesting cold storage for digital assets](https://incrypthos.com/wp-content/uploads/2025/09/immutable-ledger-shard-oracle-protocol-architecture-digital-asset.jpeg)

## Briefing

Venus Protocol, a prominent decentralized finance (DeFi) lending platform, successfully recovered $13.5 million in cryptocurrency following a targeted phishing attack on September 2, 2025. This incident, attributed to the North Korea-linked Lazarus Group, leveraged a compromised user’s [delegated account control](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) to drain assets. The rapid, 12-hour recovery, facilitated by an emergency governance vote and collaborative security efforts, marks a significant precedent in DeFi incident response, demonstrating the potential for decentralized systems to mitigate substantial financial losses.

![The image displays a frosted white sphere positioned on a translucent blue, wave-like structure, which is embedded within a metallic, grid-patterned surface. In the background, another smaller, smooth white sphere is visible, slightly out of focus](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-finance-liquidity-bridging-blockchain-interoperability-protocols.jpeg)

## Context

Prior to this event, the DeFi landscape has grappled with persistent threats stemming from sophisticated social engineering tactics and off-chain vulnerabilities. While smart contract audits are standard, the attack surface extends to [user-level security](https://incrypthos.com/tech/ethereum-pectra-upgrade-introduces-account-abstraction-enhancing-user-experience/), where phishing remains a primary vector for private key compromise or, in this instance, delegated authority exploitation. This incident highlights the enduring challenge of securing the human element within decentralized ecosystems, often overlooked when focusing solely on contract-level security.

![An intricate abstract composition showcases flowing translucent blue and clear structural elements, converging around a polished metallic cylindrical core, all set against a neutral grey background. The design emphasizes layered complexity and interconnectedness, with light reflecting off the smooth surfaces, highlighting depth and material contrast and suggesting a dynamic, engineered system](https://incrypthos.com/wp-content/uploads/2025/09/blockchain-protocol-architecture-transparent-digital-asset-flow.jpeg)

## Analysis

The attack vector bypassed direct [smart contract](https://incrypthos.com/research/llms-automate-smart-contract-formal-verification-property-generation/) vulnerabilities, instead exploiting a major user, Kuan Sun, through a malicious Zoom client. This granted the Lazarus Group delegated control over the user’s account, enabling them to execute borrowing and redemption operations on the Venus Protocol as if they were the legitimate user. The compromise of an off-chain client to gain on-chain control illustrates a sophisticated pivot by threat actors, leveraging a traditional cybersecurity weakness to manipulate a DeFi protocol without directly breaching its core contracts.

![A fragmented blue sphere with icy textures sits on a layered blue platform, surrounded by white clouds and bare branches. In the background, a smaller white sphere and two blurry reflective spheres are visible against a grey backdrop](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-architecture-digital-asset-fragmentation-ecosystem.jpeg)

## Parameters

- **Targeted Protocol** ∞ [Venus Protocol](https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/)

- **Attack Vector** ∞ Phishing via malicious client leading to [delegated account](https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/) control

- **Threat Actor** ∞ [Lazarus Group](https://incrypthos.com/news/lazarus-group/)

- **Financial Impact** ∞ $13.5 Million (recovered)

- **Response Time** ∞ Less than 12 hours

- **Recovery Mechanism** ∞ [Emergency governance](https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/) vote and forced liquidation

![A central, white, segmented cylindrical mechanism forms the core, flanked by clusters of metallic blue, geometric blocks. Soft, white, cloud-like formations partially obscure these block clusters, creating a dynamic interplay](https://incrypthos.com/wp-content/uploads/2025/09/dlt-infrastructure-cloud-data-processing-unit.jpeg)

## Outlook

This incident necessitates a renewed focus on comprehensive user security education and the implementation of multi-layered authentication for delegated permissions across DeFi. Protocols should consider enhanced monitoring for anomalous delegated activity and robust emergency response frameworks, including the capacity for rapid [governance](https://incrypthos.com/news/governance/)-led interventions. The successful recovery sets a new benchmark for crisis management in DeFi, potentially influencing future security best practices and the design of more resilient governance models to counter sophisticated, multi-faceted threats.

![Close-up view of intricately connected white and dark blue metallic components, forming a sophisticated, angular mechanical system. The composition highlights precise engineering with visible internal circuits and structural interfaces, bathed in cool, ethereal light](https://incrypthos.com/wp-content/uploads/2025/09/modular-blockchain-protocol-interoperability-architecture-for-digital-assets.jpeg)

## Verdict

**This incident unequivocally demonstrates that while smart contracts may be robust, the broader attack surface of [decentralized finance](https://incrypthos.com/news/decentralized-finance/) now critically includes user-level security, demanding integrated off-chain and on-chain defense strategies.**

Signal Acquired from ∞ <a href="https://www.ainvest.com/news/defi-12-hour-heist-governance-stopped-lazarus-hack-2509/?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">ainvest.com</a>

## Glossary

<a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account control 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/tech/ethereum-pectra-upgrade-introduces-account-abstraction-enhancing-user-experience/" class="glossary-item-box">

## user-level security 

The Pectra upgrade integrates EIP-7702, fundamentally enhancing wallet programmability and abstracting transaction complexities for broader adoption. </a><a href="https://incrypthos.com/research/llms-automate-smart-contract-formal-verification-property-generation/" class="glossary-item-box">

## smart contract 

This research integrates large language models with formal verification to automatically generate precise properties, fundamentally enhancing smart contract security. </a><a href="https://incrypthos.com/security/venus-protocol-user-account-compromised-by-phishing-attack/" class="glossary-item-box">

## venus protocol 

A sophisticated phishing operation leveraged social engineering to gain delegated account control, exposing user assets to unauthorized liquidation. </a><a href="https://incrypthos.com/research/scalable-zero-knowledge-proofs-for-private-analytics-and-delegated-computation/" class="glossary-item-box">

## delegated account 

This research introduces cryptographic primitives enabling scalable zero-knowledge proofs for private analytics and delegated computation, fundamentally reshaping decentralized system efficiency. </a><a href="https://incrypthos.com/news/lazarus-group/" class="glossary-item-box">

## lazarus group 

Definition ∞ The Lazarus Group is a clandestine state-sponsored hacking collective, widely attributed to North Korea, known for its involvement in cybercrime, particularly cryptocurrency theft. </a><a href="https://incrypthos.com/web3/makerdao-rebrands-to-sky-unveils-usds-stablecoin-and-sky-governance-token/" class="glossary-item-box">

## emergency governance 

Sky Protocol's strategic rebrand and token upgrades enhance capital efficiency and governance accessibility within the stablecoin ecosystem. </a><a href="https://incrypthos.com/news/governance/" class="glossary-item-box">

## governance 

Definition ∞ Governance refers to the systems, processes, and rules by which an entity or system is directed and controlled. </a><a href="https://incrypthos.com/news/decentralized-finance/" class="glossary-item-box">

## decentralized finance 

Definition ∞ Decentralized finance, often abbreviated as DeFi, is a system of financial services built on blockchain technology that operates without central intermediaries. </a>

**Tags:** [Compromise](https://incrypthos.com/news/compromise/), [Decentralized Finance](https://incrypthos.com/news/decentralized-finance/), [Supply Chain](https://incrypthos.com/news/supply-chain/), [Protocol](https://incrypthos.com/news/protocol/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Governance](https://incrypthos.com/news/governance/)	

## Discover More

- 
### [Polkadot DAO Caps DOT Supply at 2.1 Billion](https://incrypthos.com/web3/polkadot-dao-caps-dot-supply-at-2-1-billion/)
![A sleek, metallic structure, possibly a hardware wallet or node component, features two embedded circular modules depicting a cratered lunar surface in cool blue tones. This visual metaphor signifies moonshot potential within the decentralized finance DeFi ecosystem. The reflective surfaces imply on-chain transparency and data integrity, crucial for blockchain operations. The deep blue, star-speckled background evokes the vast Web3 frontier, highlighting the pursuit of scalability solutions and interoperability protocols to achieve exponential growth for digital assets and utility tokens. This design embodies the ambition for groundbreaking protocol innovation.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-finance-lunar-trajectory-protocol-scalability-solutions.jpeg)

Polkadot's community-driven tokenomics revision introduces a hard supply cap, enhancing scarcity and aligning with institutional investment theses.

- 
### [Shibarium Bridge Suffers Flash Loan Validator Key Compromise](https://incrypthos.com/security/shibarium-bridge-suffers-flash-loan-validator-key-compromise/)
![A polished metallic circular component, resembling a secure element, rests centrally on a textured, light-grey substrate, likely a flexible circuit or data ribbon. This assembly is set within a vibrant, translucent blue environment, exhibiting dynamic, reflective contours suggestive of a complex network or liquidity pool. This intricate setup embodies advanced cryptographic key management within a hardware wallet's secure enclave, crucial for digital asset security and seamless decentralized finance DeFi interoperability on a distributed ledger technology DLT network, facilitating smart contract execution.](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-key-management-within-a-secure-enclave-architecture.jpeg)

A flash loan attack manipulated Shibarium's validator consensus, enabling unauthorized asset siphoning and exposing critical governance vulnerabilities.

- 
### [Avantis Launches Derivatives Protocol on Base with AVNT Token](https://incrypthos.com/web3/avantis-launches-derivatives-protocol-on-base-with-avnt-token/)
![A visual metaphor for a decentralized network within a liquidity pool. Two robust, blue digital assets, resembling icebergs, represent immutable ledger base layers. White, cloud-like gas fees emanate from these protocol layer structures, signifying computational effort. A transparent, concentric ring structure, symbolizing smart contract execution or Layer 2 scaling solutions, propagates outwards, illustrating transaction flow and network throughput. This abstract representation highlights on-chain activity and the dynamic Web3 ecosystem, emphasizing scalability and interoperability within distributed ledger technology.](https://incrypthos.com/wp-content/uploads/2025/09/immutable-ledger-smart-contract-execution-flow-representation.jpeg)

Avantis introduces a high-throughput derivatives platform on Base, enhancing capital efficiency and expanding sophisticated trading primitives for the EVM ecosystem.

- 
### [BNB Reaches New All-Time High amid Broader Market Optimism](https://incrypthos.com/markets/bnb-reaches-new-all-time-high-amid-broader-market-optimism/)
![Intricate metallic components interlock with a vibrant, textured blue substance, depicting high-performance blockchain architecture. Silver elements, resembling validator node infrastructure and protocol layers, display etched patterns signifying cryptographic hashing and data integrity. The dynamic blue material, a decentralized ledger data stream or liquid staking energy flow, contains luminous particles, symbolizing active transaction finality and on-chain data processing. This visual metaphor illustrates robust Web3 backbone components facilitating smart contract execution and network consensus within a secure distributed computing environment.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-data-stream-interoperability-protocol-infrastructure-design.jpeg)

BNB achieved a record price of 963 USDT, reflecting strong market demand and positive sentiment across the crypto landscape.

- 
### [JPMorgan Advances Institutional Stablecoin and Real-World Asset Tokenization](https://incrypthos.com/adoption/jpmorgan-advances-institutional-stablecoin-and-real-world-asset-tokenization/)
![A dynamic, frosted blue and white structure, reminiscent of a stablecoin liquidity pool, dominates the foreground. Granular white and blue particles, symbolizing distributed ledger transaction data or gas fees, scatter across a reflective surface. A clear, textured oracle sphere rests amidst the token distribution, while a blurred metallic asset representation sits in the background. This visual metaphor highlights cryptographic primitives and the intricate network topology of a decentralized finance ecosystem, emphasizing protocol security.](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-primitive-frost-decentralized-ledger-governance-mechanism.jpeg)

JPMorgan's initiatives integrate digital assets into core financial operations, enhancing liquidity and efficiency for institutional clients.

- 
### [Nemo Protocol Suffers $2.6 Million Exploit from Unaudited Code](https://incrypthos.com/security/nemo-protocol-suffers-2-6-million-exploit-from-unaudited-code/)
![White, modular, metallic components connect in a chain-like fashion, forming a futuristic processing unit. Vibrant blue liquid or energy vigorously flows and splashes within an open central segment, propelled by internal mechanisms. This represents a high-performance distributed ledger technology DLT system, where transaction throughput is optimized. The dynamic blue flow symbolizes liquidity pools and on-chain data streams being processed by validator nodes within a modular blockchain architecture. It highlights efficient smart contract execution and cross-chain interoperability, essential for robust DeFi protocols and scalable Web3 infrastructure, underpinned by secure cryptographic primitives across a decentralized network.](https://incrypthos.com/wp-content/uploads/2025/09/modular-protocol-engine-executing-high-velocity-liquidity-pool-transactions.jpeg)

A publicly exposed flash loan function and state-modifying query vulnerability allowed unauthorized asset drainage, posing a critical risk to protocol integrity.

- 
### [JPMorgan and Visa Advance Institutional Blockchain Integration](https://incrypthos.com/adoption/jpmorgan-and-visa-advance-institutional-blockchain-integration/)
![A sleek, white and metallic blue industrial mechanism features interconnected components, suggesting precision engineering and automated functionality. This modular system evokes the intricate design of a decentralized autonomous organization DAO or smart contract execution engine. Its linear guides and robust structure symbolize the immutable records and trustless environments foundational to distributed ledger technology DLT. The assembly could represent a validator node or a component within a layer-2 scaling solution, facilitating transaction finality. Abstract markings hint at complex cryptographic primitives or hashing algorithms underpinning Web3 infrastructure, articulating robust protocol layers for secure digital asset management.](https://incrypthos.com/wp-content/uploads/2025/09/precision-blockchain-infrastructure-for-automated-decentralized-finance.jpeg)

Enterprises leverage tokenization and stablecoins to optimize transaction settlement and enhance cross-border payment rails, driving significant operational efficiencies.

- 
### [Optimal MEV Arbitrage Splits Trades on Fast-Finality Blockchains](https://incrypthos.com/research/optimal-mev-arbitrage-splits-trades-on-fast-finality-blockchains/)
![The image showcases a luminous, translucent blue-grey amorphous structure enveloping a vibrant, solid blue sphere. This abstract rendering visually represents a DeFi liquidity pool where digital assets are tokenized and secured within a smart contract. The fluid, protective form symbolizes the protocol's robust security mechanisms and interoperability within a decentralized network. The core sphere embodies a governance token or native cryptocurrency, highlighting its asset custody and yield farming potential, reflecting dynamic blockchain interactions.](https://incrypthos.com/wp-content/uploads/2025/09/defi-liquidity-pool-smart-contract-asset-protection.jpeg)

This research reveals that arbitrageurs on fast-finality blockchains maximize profit by splitting MEV opportunities into small, spam-based transactions, exposing critical flaws in current fee mechanisms.

- 
### [Crypto Market Dips as Investors Await Fed Rate Cut Decision](https://incrypthos.com/markets/crypto-market-dips-as-investors-await-fed-rate-cut-decision/)
![A highly detailed, metallic-blue and silver geometric construct, possibly a cryptographic module or validator node, floats centrally. Its intricate design features layered secure enclaves and embedded faceted blue elements, symbolizing encrypted data units or tokenized assets. This structure suggests advanced hardware wallet capabilities for cold storage or a component within a decentralized infrastructure. The background displays blurred, luminous blue spheres, representing distributed ledger technology DLT nodes or blockchain network data points, emphasizing trustless system operations and immutable ledger integrity. The composition highlights protocol layer security.](https://incrypthos.com/wp-content/uploads/2025/09/secure-enclave-cryptographic-module-for-decentralized-network-validation.jpeg)

The crypto market is seeing a slight dip today as investors cautiously await the US Federal Reserve's interest rate decision.

**Tags:** [Compromise](https://incrypthos.com/news/compromise/), [Decentralized Finance](https://incrypthos.com/news/decentralized-finance/), [DeFi](https://incrypthos.com/news/defi/), [DeFi Security](https://incrypthos.com/news/defi-security/), [Delegated Control](https://incrypthos.com/news/delegated-control/), [Digital Assets](https://incrypthos.com/news/digital-assets/), [Fund Recovery](https://incrypthos.com/news/fund-recovery/), [Governance](https://incrypthos.com/news/governance/), [Governance Vote](https://incrypthos.com/news/governance-vote/), [Lazarus Group](https://incrypthos.com/news/lazarus-group/), [Phishing](https://incrypthos.com/news/phishing/), [Phishing Attack](https://incrypthos.com/news/phishing-attack/), [Protocol](https://incrypthos.com/news/protocol/), [Recovery](https://incrypthos.com/news/recovery/), [Security](https://incrypthos.com/news/security/), [Supply Chain](https://incrypthos.com/news/supply-chain/), [Threat Intelligence](https://incrypthos.com/news/threat-intelligence/), [User Compromise](https://incrypthos.com/news/user-compromise/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Venus Protocol User Phished, Lazarus Group Recovers $13.5 Million",
            "item": "https://incrypthos.com/security/venus-protocol-user-phished-lazarus-group-recovers-13-5-million/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/venus-protocol-user-phished-lazarus-group-recovers-13-5-million/"
    },
    "headline": "Venus Protocol User Phished, Lazarus Group Recovers $13.5 Million \u221e Security",
    "description": "A sophisticated phishing attack compromised user delegation, underscoring critical risks in off-chain security and user education. \u221e Security",
    "url": "https://incrypthos.com/security/venus-protocol-user-phished-lazarus-group-recovers-13-5-million/",
    "datePublished": "2025-09-17T07:52:09+00:00",
    "dateModified": "2025-09-17T07:52:13+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/liquid-cooling-protocol-optimizing-decentralized-ledger-technology-performance.jpeg",
        "caption": "A detailed perspective showcases a futuristic technological apparatus, characterized by its transparent, textured blue components that appear to be either frozen liquid or a specialized cooling medium, intertwined with dark metallic structures. Bright blue light emanates from within and along the metallic edges, highlighting the intricate design and suggesting internal activity. This advanced hardware represents a critical element within a high-performance blockchain infrastructure, engineered for optimal thermal management. Such a system is indispensable for sustaining the intensive computational demands of validator nodes or mining rigs, directly impacting network consensus and transaction throughput. The innovative liquid cooling protocol depicted ensures the stability and longevity of critical components, mitigating overheating risks during continuous cryptographic hashing and smart contract execution. This specialized module underscores the ongoing advancements in building scalable and energy-efficient decentralized networks, contributing to the overall robustness and data integrity of the distributed ledger technology. It exemplifies the sophisticated engineering required for next-generation digital asset management and DeFi protocol operations."
    },
    "keywords": [
        "Compromise",
        "Decentralized Finance",
        "DeFi",
        "DeFi Security",
        "Delegated Control",
        "Digital Assets",
        "Fund Recovery",
        "Governance",
        "Governance Vote",
        "Lazarus Group",
        "Phishing",
        "Phishing Attack",
        "Protocol",
        "Recovery",
        "Security",
        "Supply Chain",
        "Threat Intelligence",
        "User Compromise"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/venus-protocol-user-phished-lazarus-group-recovers-13-5-million/
