On March 15, 2026, the leading lending protocol on BNB Chain, Venus Protocol, had its vTHE pool reported to have possibly encountered attacks similar to those of Mango Markets, involving flash loans and price manipulation, triggering heightened tension across the on-chain lending market. The attack address 0x1a35...6231 borrowed BTCB, CAKE, and BNB from Venus after heavily collateralizing THE, subsequently exiting profitably while leaving around 42 million THE (approximately 14 million USD) in collateral positions pending liquidation, as well as a severely disrupted secondary market price: THE was violently pumped to 0.6 USD in a very short time, then smashed back from the 0.21-0.24 USD range, presenting a typical manipulated "roller coaster" effect. This pattern highly resembles the Mango Markets incident from years past and quickly amplified market pessimism regarding the safety and systemic risks of BNB Chain.

THE Pumped and Then Liquidated: Attack Path Emerges

● Collateral Expansion: Public chain information shows that the suspected attack address 0x1a35...6231 first concentrated on acquiring and pushing up the price of THE in the secondary market, then injected a large amount of THE into the Venus vTHE pool as collateral. After the oracle price was artificially pushed up, the dollar valuation of its collateral position greatly expanded, enabling large borrowings of high liquidity assets like BTCB, CAKE, and BNB from Venus in a short period, creating space for subsequent profit-taking.

● Mango Model Replicated: This mode is highly similar to the Mango Markets incident in 2022—where attackers also first drastically increased the price of a low liquidity asset to amplify the collateral value, then "over-leveraged borrowings" of high-value assets in the lending protocol. The difference is that the current Venus incident leans more towards a combination of price manipulation and collateral expansion, rather than direct market-making within the protocol; however, both expose the long-standing issue of price oracles + long-tail asset collateral not truly being patched up.

● Price and Collateral Linked: Briefing shows that the price of THE increased sharply from 0.21-0.24 USD to 0.6 USD in a very short time, with an increase of about 90%-116%, greatly amplifying the nominal value of the collateral positions during this period, allowing the attacker to extract about 20 BTC, 1.5 million CAKE, and 200 BNB (equivalent to 3.6-3.7 million USD) from Venus. When buying pressure retreated and prices fell, the inflated collateral position instantaneously turned into high-risk bad debt, triggering a liquidation mechanism that dragged the market into a downward spiral.

● Restoring Boundaries: It is important to emphasize that current public information does not specify the detailed operational sequence and exact flash loan path of the attacker, and Venus has not yet published a complete review. This article outlines the profile based on oracle price anomalies, collateral position structure, and final profit size without making any fictional supplements to unreported on-chain details.

Price Surged 90% to Liquidation of 2.13 Million: The Fragile Liquidity of Long-Tail Coins

● Market Structure Torn: On March 15, Eastern Eight Zone, during trading, the price of THE was rapidly lifted from the 0.21-0.24 USD range to 0.6 USD, with a near 1-fold increase in a short period. Given the already limited liquidity, such a level of funding push was sufficient to tear the buy-sell structure, forming an extremely unnatural vertical uptrend, also laying the groundwork for subsequent high-level selling.

● Leverage Crunch: According to multiple media outlets including Golden Finance, Rhythm, Planet Daily, and Foresight, within 4 hours after the incident broke out, the entire network faced approximately 2.13 million USD in liquidations related to THE. This means that not only did collateral positions within Venus encounter risks, but also on-chain long positions and high-leverage contracts related to THE suffered concentrated liquidations during the price correction, further exacerbating selling pressure and market panic.

● 42 Million THE Liquidation Cascade: After the attacker extracted approximately 3.6-3.7 million USD worth of assets, about 42 million THE (approximately 14 million USD) of collateral positions on Venus were pushed into liquidation territory. For such deeply weak long-tail assets, such concentrated selling expectations alone were enough to ruin market confidence; once liquidation bots and arbitrageurs began selling, this batch of chips would come crashing down onto the market like a waterfall.

● Sudden Shift in Sentiment: Looking at the media reporting pace, the market initially viewed the abnormal surge in THE and unexpected fluctuations in the Venus vTHE pool more from a "curiosity" and "arbitrage opportunity" perspective; as the liquidation data, the scale of liquidations, and the attack profit numbers were gradually disclosed, public opinion rapidly shifted within hours to focus on serious inquiries about price manipulation, security of lending protocols, and systemic risks of BNB Chain, with panic sentiment beginning to spill over to a broader range of DeFi assets.

From Mango to Venus: The Old Problem of Oracles and Long-Tail Collateral

● Weakness Replayed: Multiple organizations, including Foresight, pointed out that the shared weakness of the Venus incident and Mango Markets lies in: first, insufficient resistance to manipulation of single trading pairs or short-term anomalies by price oracles, and second, over-trust in low liquidity long-tail assets as collateral. When these two points overlap, attackers only need to leverage relatively small spot depths to pry open the entire lending risk management.

● Risk Whitelist Lagging: Briefing information indicates that THE token had not previously entered the mainstream risk monitoring list, and was still regarded as an ordinary long-tail asset in many institutions and risk systems. This implies that the protocol's asset whitelist, collateral parameters, and monitoring thresholds likely did not differentiate based on its liquidity and volatility features, with risk control adjustments significantly lagging behind the evolution of on-chain asset risks.

● Structural Defects: From a system design perspective, allowing high volatility, low depth long-tail assets to bear high collateral rates or low liquidation penalties means transferring liquidation risks to the entire protocol and other depositors. When prices are manipulated higher, the "safe" collateral rate on the books is merely an illusion; when prices revert or even plummet drastically, the liquidation mechanism can instantaneously fail in the absence of buying support, resulting in substantial bad debt risks.

● Increasing Attacks: According to PANews statistics, since Q4 2025, flash loan attack incidents have increased by approximately 37%. The suspected price manipulation and flash loan combination attack faced by Venus this time is not an isolated case but a type of systemic threat that the entire DeFi industry is increasingly facing under the context of highly complex financial structures + asymmetrical attack costs.

42 Million THE Awaiting Liquidation: A Negative Feedback Loop of On-Chain Crashes

● Fatal Concentration of Small Coins: About 42 million THE (approximately 14 million USD) are concentrated in the collateral positions of the Venus vTHE pool; once penetrated by price drops, it indicates that a massive amount of chips needs to find buyers in a spot market where liquidity is far from matching. For such long-tail assets, any highly concentrated collateral positions on a single protocol pose a potential "single point of failure" risk.

● Robots Accelerating Fall: After triggering liquidation, on-chain liquidation bots will automatically throw THE into the market to recover debts based on preset rules; at the same time, arbitrageurs will capture price differentials, further shorting or selling chips in the secondary market. This combination of algorithmic liquidation + manual arbitrage will amplify the already fragile selling pressure within a short time, forming a typical negative feedback loop: the faster prices drop, the more positions go into liquidation, which, in turn, continues to hammer the market.

● Leverage Amplification Effect: As a result, the attacker extracted about 3.6-3.7 million USD in profits, leveraging the approximately 14 million USD worth of THE collateral fund on Venus. This close to 1:4 risk leverage demonstrates the combined power of price manipulation and lending protocol leverage mechanisms: the attacker bears the short-term price manipulation and operational risks, while the protocol and other participants jointly absorb market risk exposures far greater than the attacker’s principal.

● Chain Reaction Concerns: When a leading lending protocol experiences such a large-scale liquidation crunch on a single long-tail asset, the market naturally recalls similar long-tail collateral assets in other DeFi protocols: Is there a similar concentration? Is there also a lack of differentiated risk control? Does it rely similarly on price oracle quotes sensitive to a single trading pair? Such worries alone can suppress risk appetite across a broader range, triggering a new round of collective scrutiny of DeFi risk management frameworks.

BNB Chain Frequently Targeted: The Security Cost of an Active Ecosystem

● Systemic Hierarchy of Leading Lendings: As a leading lending protocol on BNB Chain, the TVL of Venus Protocol previously peaked above 5 billion USD in 2025 and plays a role akin to a "central clearinghouse" in the entire on-chain financial system. Thus, this incident involving the vTHE pool is not merely a single protocol risk event but is viewed as a stress test on the overall resilience of BNB Chain's financial infrastructure.

● Impression of Frequent Security Events: In recent years, multiple projects on BNB Chain have encountered attacks or contract vulnerabilities, leading to the market's perception of "high activity accompanied by high attack frequency". On one hand, rich projects and high TVL attract developers and users; on the other hand, this objectively expands the attack surface, making hackers more inclined to view the BNB ecosystem as a testing ground for new attack techniques.

● Dual Nature of Low Fees and Thresholds: BNB Chain is known for its low transaction fees, high throughput, and relatively lenient project admission thresholds, which is conducive to rapidly incubating projects and attracting long-tail assets, but also lowers the admission standards for some projects regarding security audits, risk control structures, and oracle choices. When long-tail assets surge on-chain while risk control and oracle mechanisms fail to upgrade simultaneously, it provides opportunities for similar events like the current one.

● Possible Directions for Improvement: For Venus and the broader BNB ecosystem, following this incident, iteration of oracle structures, multi-asset risk control frameworks, and risk control black/white listing systems has become almost unavoidable. This includes implementing more conservative collateral rates and liquidation discounts for long-tail assets, introducing multi-source oracles with stricter price anomaly detection, and conducting systematic stress tests before incorporating assets into the collateral whitelist, all of which are repeatedly mentioned directions for improvement by the market.

In the Gap Between Price and Liquidation, Where Will DeFi Go Next?

This incident surrounding the Venus vTHE pool once again exposes the fundamental issues of decentralized lending models under the spotlight: Collateral rates and oracles have never been a “universal insurance plug”. When the collateral itself consists of high-volatility, low-depth long-tail assets, even the most refined parameter settings can hardly fully withstand the combined effects of price manipulation and flash loans; the traditional narrative of “over-collateralization + real-time liquidation” is being repeatedly breached in practical scenarios.

In the future, DeFi protocols must move towards a more granular risk layering and quota management when accepting long-tail assets: differentiating collateral and liquidation tiers for blue-chip and long-tail assets, designing dedicated defense modules for flash loans and extreme volatility, and even building emergency deceleration mechanisms against “suspected manipulated prices” within the protocol. At the same time, auditing firms, risk monitoring services, and community governance will be expected to take on more roles: the former must provide stricter safety assessments prior to introducing assets and parameter adjustments, the latter should reduce the success rate of attacks through on-chain surveillance and anomaly alerts, and the latter will provide more transparent decision-making processes in post-incident handling, loss sharing, and mechanism upgrades. DeFi stands at the crossroads of a new round of security games, and the gap between price and liquidation is being ruthlessly torn open by successive attack events.

Join our community, let's discuss and grow stronger together!
Official Telegram community: https://t.me/aicoincn
AiCoin Chinese Twitter: https://x.com/AiCoinzh

OKX benefits group: https://aicoin.com/link/chat?cid=l61eM4owQ
Binance benefits group: https://aicoin.com/link/chat?cid=ynr7d1P6Z

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。