A sophisticated donation attack on Venus Protocol’s Thena (THE) market has exposed a critical vulnerability in how lending platforms calculate collateral values. On March 15, 2026, an attacker exploited the gap between deposit caps and direct token transfers to drain approximately $2.15 million from the BNB Chain-based lending protocol—and the mechanics of this exploit carry lessons for every DeFi user holding funds in similar platforms.
The Exploit Mechanics
The attack targeted Venus Protocol’s THE market, a Compound V2 fork where users deposit THE tokens and receive vTHE in return. The exchange rate—which determines how much each vTHE is worth—is calculated using a straightforward formula: (cash + borrows – reserves) divided by total supply. The critical weakness lay in how “cash” is derived: directly from the contract’s raw token balance.
Because the contract reads its token balance directly from the blockchain, anyone can transfer THE tokens to the contract without going through the normal deposit process. These “donated” tokens inflate the cash variable, which in turn inflates the exchange rate. The attacker exploited this by transferring a large quantity of THE directly to the vTHE market contract, artificially boosting the exchange rate approximately 3.81 times its true value.
With the exchange rate inflated, the attacker’s existing vTHE holdings suddenly appeared far more valuable than they actually were. The protocol’s supply cap—designed to limit total collateral exposure—only applied to the mint path, meaning direct donations bypassed this safeguard entirely.
Affected Systems
The exploit specifically targeted the vTHE market contract on BNB Chain (address 0x86e0…739f). Venus Protocol, as a Compound V2 fork, shares its core architecture with numerous other lending platforms across multiple chains. Any Compound V2-based lending market that derives cash from raw token balances is theoretically vulnerable to the same donation attack vector.
The attack also involved market manipulation. After inflating the exchange rate, the attacker used their artificially inflated collateral position to borrow liquid assets, acquiring more THE tokens while simultaneously driving up the token’s market price. This dual-pronged approach—combining the on-chain donation attack with off-chain market manipulation—amplified the damage and made recovery more difficult for the protocol.
When the position was eventually force-liquidated, the protocol was left holding the bag: approximately $2.15 million in bad debt with insufficient collateral to cover it.
The Mitigation Strategy
Preventing donation attacks requires a fundamental change in how lending protocols track collateral. Instead of reading raw token balances from the contract, protocols should maintain an internal accounting variable that only increases through the official deposit function. This “internal balance” approach immunizes the exchange rate from arbitrary token transfers.
Several protocols have already adopted this pattern. Aave V3, for instance, uses a more granular accounting system that separates internal balances from raw contract balances. Similarly, new-generation lending platforms like Morpho and Spark implement supply caps at the accounting level rather than relying solely on the mint path.
For existing Compound V2 forks, the mitigation involves upgrading the exchange rate calculation to use an internally tracked balance rather than the raw ERC-20 balance. This is a non-trivial change that requires careful auditing, as it affects the core collateralization logic of the entire protocol.
Lessons Learned
This incident underscores that supply caps are meaningless if they can be bypassed through alternative token transfer paths. Protocol designers must ensure that every mechanism affecting collateral valuation is covered by the same protective guardrails. The gap between the deposit cap and the donation vector created a blind spot that the attacker exploited with precision.
The combination of on-chain and off-chain attack vectors also highlights the importance of oracle-based collateral monitoring. If Venus had been monitoring real-time price feeds and exchange rate anomalies, the 3.81x inflation in collateral value could have triggered automated circuit breakers before the attacker completed the full exploit chain.
As BlockSec’s weekly report documented, this was just one of seven attacks during the week of March 16-22, 2026, which collectively cost DeFi users over $82.7 million. The Venus incident demonstrates that even established protocols on major chains remain vulnerable to well-known attack patterns when implementation details create unexpected gaps in their security model.
User Action Required
If you have funds deposited in any Compound V2-based lending market, check whether the protocol uses raw token balances for exchange rate calculations. Look for audit reports that specifically address donation attack vectors. Consider moving funds to protocols that use internal balance tracking or have published mitigations for this class of vulnerability. With Bitcoin trading at approximately $67,845 and Ethereum at $2,053 on March 22, 2026, the broader market downturn added additional pressure to already-stressed lending markets—making it even more critical to verify that your collateral is accurately valued.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before making investment decisions.
bypassing the supply cap through direct token transfers instead of the mint path. the gap between deposit and donation was a design flaw hiding in plain sight
donation_attk the supply cap was basically a suggestion not a constraint. compound v2 forks need internal balance accounting or this will keep happening
donation_attk exactly. the deposit cap means nothing if someone can bypass it with a raw transfer. reading token balance directly from the contract instead of an internal accounting variable is the kind of mistake Compound V2 forks keep inheriting
compound_v2_ghost_ reading raw token balance instead of an internal accounting variable is such a basic mistake. every Compound fork should audit for this specific pattern before deploying
Hardware wallet adoption is the single biggest security improvement anyone can make
reading the balance directly from the contract instead of using a deposit accounting function is such a basic design failure. compound v2 forks keep repeating this same mistake
vthe_fragility_ the worst part is venus knew about this class of attack. donation attacks on compound forks were documented since 2022 and nobody patched it
Cassia M. documented since 2022 and still unpatched in 2026. at some point its not a bug anymore its a design choice to ignore known vulnerabilities
The industry needs standardized security audit frameworks
Dmitri Volkov standardized audit frameworks wont catch this. the cash variable reading raw token balance is technically correct behavior, just economically exploitable
Olga Petrov standardizing audit frameworks would not have caught this. the code was technically correct, it just had an economic exploit. you need game theory review not just code review
Inka S. exactly, code review catches bugs but not economic exploits. you need adversarial thinking not just test coverage
$2.15M drained because someone could just transfer tokens to the contract and inflate the exchange rate. decentralization without basic accounting controls is just expensive theater
reentrancy_watch_ reading raw balance instead of tracked accounting variable is a Compound V2 original sin. every fork inherits this and nobody patches it until 2.15M disappears
Bridge security is still the weakest link in the ecosystem
Real-time monitoring tools are getting better at catching exploits early
Formal verification should be mandatory for high-value protocols
reading the exchange rate formula and immediately thinking yeah just transfer tokens directly to the contract was exactly how the attacker thought. compound v2 forks all share this disease
rekt_anatomist_ compound v2 exchange rate manipulation has been documented since 2020. the fact that venus shipped without a deposit cap check in 2026 is negligence not a bug
2.15M gone because nobody thought to cap direct token transfers. every lending protocol forked from compound needs to check this right now honestly
$2.15M drained because nobody questioned why cash was derived from raw balance instead of a tracked variable. feels like 2022 all over again
the deposit cap gave users a false sense of security. it only controlled the mint path while the contract balance was wide open to direct transfers. deposit caps need to account for donations