Venus hit by supply cap manipulation attack, attacker planned for 9 months Allez Labs' latest investigation: Since June 2025, the attacker spent 9 months gradually accumulating 84% of THE tokens up to the supply cap (approximately 14.5 million tokens). Then, bypassing the normal deposit process, they directly transferred funds to the contract, pushing the position to 53.2 million tokens (3.67 times the cap). Exploiting the weakness of insufficient on-chain liquidity for THE, the attacker recursively manipulated the TWAP oracle, driving the price from 0.27 to 0.53. Subsequently, they used 53.2 million THE as collateral to borrow assets including 6.67 million CAKE, 2,801 BNB, and 1.58 million USDC. Currently, lending and withdrawals for THE and other markets with highly concentrated liquidity like BCH, LTC, and UNI have been suspended, while other Venus markets remain operational. The investigation is still ongoing.