Venus Protocol (XVS): BNB Chain’s largest lender, and the collateral attacks that keep costing it

Venus Protocol is the money market most BNB Chain users meet first: you deposit BNB, bitcoin or stablecoins, earn interest, and borrow against them. On 12 November 2026 DefiLlama counted $1.07 billion of total value locked in the Venus Core Pool, 99.7% of it on BNB Chain, more than any other lender there. Everywhere else it is small.

It is also a lender with a long incident file. Thinly traded collateral has been pushed up and borrowed against in 2021, in 2025 and again in March 2026, and each time Venus was left with bad debt. The latest proposal on its forum, posted on 12 November, changes how the new Liquidity Hub counts its own assets so that tokens sent to it directly can no longer inflate its value.

What Venus Protocol is: a Compound-style lender with its own stablecoin

Venus went live on what was then Binance Smart Chain in 2020. Its documentation describes it as the combination of two older ideas: money markets in the style of Compound, where lenders and borrowers meet in shared pools, and a MakerDAO-style stablecoin minted against collateral, here called VAI. Binance Research’s 2020 profile of the project says development was fully backed by the team behind Swipe, a crypto card company, and that no token sale had been held.

The XVS governance token was first distributed through Binance Launchpool from 29 September 2020. Joselito Lizarondo was named as Venus’s founder in coverage by Forklog in 2021 and by Protos in 2023; the documentation itself does not list a team.

The mechanics follow Compound closely. A lender who supplies USDT receives vUSDT, a vToken whose exchange rate against USDT rises as borrowers pay interest. A borrower must first supply collateral; each asset has a collateral factor that caps how much can be borrowed against it. If prices move and the loan exceeds that limit, anyone can repay part of it and seize collateral at a discount. Our guide to crypto lending and borrowing covers these rules in general, and the guide to DeFi liquidations explains what happens when collateral runs out.

Core Pool, isolated pools and E-Mode

Most of the money sits in the Core Pool on BNB Chain, run by a contract called the Comptroller. All assets there share one risk profile: a deposit of BTCB can back a loan in USDT, CAKE or THE. Isolated pools, added in 2023, separate riskier assets so that a problem in one pool stays there; several of them have since been deprecated, and DefiLlama counted only about $0.8 million in them on 12 November.

E-Mode lets correlated assets be borrowed against each other on better terms. Proposal VIP-664 of 3 October 2026, for example, opened an ETH E-Mode in which wBETH, Binance’s staked ether, counts at a 90% collateral factor with a 93% liquidation threshold. Higher limits help borrowers; they also leave less room before a liquidation if the two prices drift apart.

The Liquidity Hub: one deposit, several destinations

The newest layer is the Liquidity Hub. For each asset there is one vault built on the ERC-4626 standard: a lender deposits USDT, say, and receives a share whose value against USDT grows over time instead of a balance that rebases. Governance then decides where the money goes, using two ordered lists, one for deposits and one for withdrawals.

The destinations the documentation lists are the Core Pool, Venus Flux (lending built with Fluid), fixed-rate vaults, Centrifuge tokenized fund shares, and spoke pools that the Hub funds directly. Each destination has a cap in dollars and a cap as a share of the Hub, and the stricter one applies. A withdrawal larger than the available liquidity is not partly filled: it fails in full. Management, performance and redemption fees were set at 0% at launch.

The Hub is still small. The October 2026 report that Allez Labs, Venus’s risk manager, posted on the forum says deposits grew from $5.5 million on 1 October to $17.6 million on 31 October, with 93% ($16.3 million) lent into the Core Pool and about $1 million placed in Centrifuge fund shares. Venus Flux held about $1.2 million on DefiLlama on 12 November.

Spoke markets that accept tokenized ETFs

On 23 October 2026 three proposals, VIP-668 to VIP-670, opened the first spoke markets funded by the Hub. The first is a pool in which QQQB and SPYB, tokens that track the Nasdaq 100 and S&P 500 funds, can be posted as collateral to borrow USDT or USDC. By the end of October the three Hubs had lent only about $0.1 million into it. Bailsec and Sherlock both published audits of the spoke pool code dated 23 October.

VAI, the stablecoin

VAI is minted against collateral supplied to Venus. Its stability fee has a fixed base and a floating part that rises when VAI trades below $1, which makes borrowing VAI dearer when the peg is weak, and a peg stability module swaps VAI and USDT. VAI is small: CoinGecko’s page showed about 2.48 million VAI in circulation on 12 November, and an all-time low of $0.5792. No dollars sit in a bank behind it; it is backed by crypto loans, and the oracle documentation notes that VAI’s own price comes from a single source with no pivot or fallback.

How Venus prices collateral: the Resilient Oracle

Every loan depends on the price Venus gives to the collateral, so the oracle is the part attackers aim at. Venus uses what it calls a Resilient Oracle. For each asset governance picks a main source, an optional pivot source and a fallback, drawn from Chainlink, RedStone, Binance’s own feed, Atlas and APRO, plus adapters for tokens that track another asset, such as wBETH or asBNB. The main price is accepted only if it falls within a band, typically 5% or 1%, of the pivot. The documentation is plain about the limit: where no pivot is enabled, the main price is used without a cross-check.

A newer safeguard, Protection Mode, covers thinly traded collateral. When the spot price jumps away from its recent range, the Comptroller values that collateral at the lower of the spot price and the window’s minimum, and values debt at the higher of the two. A sudden spike therefore no longer lets a borrower take out more. Liquidations still use the spot price. The documentation lists a 16.67% deviation trigger for the tokenized shares TSLAB, NVDAB, SPCXB and SKHYB, in a configuration dated 28 September 2026 (VIP-663).

Who controls Venus: XVS votes, three timelocks and guardians

Changes go through Venus Improvement Proposals (VIPs) voted with XVS. A proposer needs 1,000,000 XVS delegated to them. A proposal passes if votes in favour exceed votes against and reach at least 1,500,000 XVS, and it can carry up to 100 on-chain actions.

Approved proposals then wait in a timelock. On BNB Chain the documentation lists three routes: Normal, with a 48-hour delay; Fast-track, with 6 hours; and Critical, with 1 hour. The Critical route still exists, but VIP-645 removed every permission it held across Venus deployments, so it can no longer execute privileged actions. Emergencies now rely on guardians, which hold narrow, action-specific rights granted through an Access Control Manager, such as pausing borrowing on one market. The documentation stresses that a guardian is not a global administrator. It does not publish the guardians’ addresses, the signers behind them or a multisig threshold, and tells integrators to read the live permissions on-chain.

Day-to-day development is done by Venus Labs, a group the DAO pays. In April 2025 Venus Labs asked a Snapshot vote for $1.7 million to cover the second half of 2024, up from $1.49 million for the first half; the vote had 100% support at press time, The Block reported. Venus Labs has no published legal entity or jurisdiction. Risk management is bought from Allez Labs: the 12 November proposal includes a payment of 105,000 USDC for its services from 26 October 2026 to 25 January 2027.

The XVS token: a 30 million cap, no team allocation, and what holders get

XVS has a maximum supply of 30 million. Binance Research’s 2020 profile gives the original split: 20% (6 million XVS) through Binance Launchpool, 1% for the BNB Chain ecosystem and 79% for mining by users of the protocol, divided between lenders, borrowers and VAI minters. It lists no team or investor allocation and no vesting schedule. On 12 November CoinGecko’s page showed a total supply of 29.745 million and a circulating supply of 16.892 million.

XVS is mainly a voting token. Holders who want to vote must lock it in the XVS Vault and delegate, even to themselves: the documentation says staking alone does not activate voting power. Vault deposits earn XVS rewards set by governance, 535 XVS a day on BNB Chain for the third quarter of 2026, and count towards Venus Prime, a scheme that pays extra yield to large, long-term vault holders through non-transferable Prime tokens.

Where the money goes is set out in the tokenomics page. Reserve income, mostly a cut of borrowers’ interest, is split 40% to the treasury, 40% to Prime and 20% to the Risk Fund. Liquidation income goes 60% to the treasury, 20% to Prime and 20% to the Risk Fund. A deployment only feeds Prime and the Risk Fund once it averages at least $50,000 of revenue a month over six months; Ethereum and Arbitrum currently send everything to the treasury.

Since VIP-620 in May 2026, the protocol’s revenue is converted by TokenBuyback contracts, with an off-chain operator buying the target assets, including XVS for the treasury. Since VIP-638, executed on 1 July 2026, the share that used to reward the XVS Vault goes to Prime. A plain XVS holder therefore gets voting power and vault rewards that governance can change, not a direct claim on fees. DefiLlama’s methodology still describes 40% of borrow-interest revenue as going to holders, which reads differently from Venus’s own split.

TVL, fees and revenue of Venus Protocol in November 2026

DefiLlama counted $1,066.3 million of TVL in the Venus Core Pool at 19:27 UTC on 12 November 2026, down from $1,129.1 million on 6 November and $1,273.0 million on 14 October. BNB Chain held $1,062.8 million of it; Ethereum, Arbitrum, zkSync and Base together held about $3.5 million. Borrowing stood at $337.2 million. TVL here is deposits minus loans, which is why Venus’s own report, which counts gross supply, gives $1.48 billion for the end of October.

Fees, meaning interest paid by borrowers plus liquidation income, came to $41,598 over 24 hours, $303,089 over seven days and $1.03 million over 30 days to 12 November, and $159.8 million since launch. Most of that interest goes to lenders: DefiLlama puts the protocol’s own revenue at $192,364 over the same 30 days.

The October report, published on 10 November, gives the inside view. Debt fell 16.9% over the month to $337 million and overall utilisation was 23%, though USDC and USDT were 92.5% and 84.3% borrowed, which can make stablecoin withdrawals slow when demand peaks. The largest deposits were BTCB ($402.8 million), BNB ($394.7 million), USDT ($169.0 million) and SolvBTC ($155.6 million): Venus is above all a place to borrow stablecoins against BNB and bitcoin.

The same report counts 23,134 accounts with debt, with the four largest borrowers owing $58 million (17.2% of the total, down from 22.9% a month earlier). Its most exposed account, a borrower against BTCB, had a health factor of 1.14 and $16.3 million of collateral at risk if bitcoin fell 30%. The stress tests put bad debt at about $1.0 million after a further 30% fall in prices and $35.3 million after a 60% fall, up from $0.4 million and $23.1 million at the end of September.

Is Venus Protocol safe? The incidents since 2021

No lender is free of risk, and Venus’s record shows where its own risks lie: collateral that can be pushed around, oracles, and its closeness to Binance and BNB Chain.

May 2021: the XVS spike and about $95 million of bad debt

Overnight into 19 May 2021 the price of XVS jumped nearly 90%, from $76 to $144, The Block reported. Borrowers who had posted XVS as collateral used the higher price to borrow heavily; when XVS fell back, more than $200 million of positions were liquidated and the protocol was left with bad debt of more than $95 million, mostly in bitcoin and ether, according to The Block, or $100 million according to Forklog. The Block researcher Igor Igamberdiev argued that thin XVS liquidity on Binance made the price easy to manipulate; Lizarondo said the protocol worked as intended and that Venus would use XVS to cover the shortfall. The episode is the template for later attacks: a token used as collateral on Venus is easier to move than Venus’s own limits assumed.

May 2022: a stalled LUNA price

During the collapse of Terra, Chainlink paused its LUNA feed at its built-in floor, and Venus kept valuing LUNA at about $0.107 while it traded near $0.01. Attackers deposited cheap LUNA and borrowed against it. Reported losses range from about $11.2 million (Cointelegraph, 13 May 2022) to about $13.5 million (Forklog and Rekt). Venus said its Risk Fund would cover the shortfall. It paused the protocol, reopened it on 16 May with price feeds switched off, so that users could only supply and repay, and proposal VIP-61 set the LUNA and UST collateral factors to zero.

2022 to 2023: the BNB Chain bridge hacker as a borrower

After the October 2022 attack on BNB Chain’s cross-chain bridge, the attacker deposited about $200 million of BNB on Venus and took a $110 million stablecoin loan against it, DL News reported. The position was large enough to threaten the protocol if BNB fell, and in November 2022 the DAO voted to make BNB Chain the sole liquidator of that account. In August 2023 about $63 million of the position was liquidated, Bloomberg reported. The episode showed how much a single position on Venus depends on decisions taken around Binance and BNB Chain.

February 2025: a donation attack on zkSync

On 27 February 2025 an attacker used a flash loan from Aave to inflate the exchange rate of wUSDM, a vault token on Venus’s zkSync market, by sending USDM straight to the vault, then used the distorted price to liquidate and extract value. A post-mortem by Chaos Labs on the Venus forum put the bad debt at $902,159 and the net loss at $716,789, after liquidation fees; Rekt gives the same figures. The post noted that the ERC-4626 vault standard has no protection against exchange rates manipulated in this way.

September 2025: a phished user and $13.5 million recovered

On 2 September 2025 a Venus user lost about $13 million after installing a malicious Zoom client, according to SlowMist’s analysis. The attacker worked through the victim’s compromised computer, not through a flaw in the contracts, which Venus said were not compromised. Venus paused the protocol, the DAO voted to liquidate the attacker’s position, and $13.5 million was recovered, Cointelegraph reported. The case shows how far governance can reach into a single account when it chooses to.

March 2026: the THE market

On 15 March 2026 an attacker pushed the price of THE, the token of the Thena exchange, from about $0.27 to nearly $5 on one venue, according to researcher Weilin Li quoted by The Block, while the price Venus used rose only to about $0.50. To get round the THE supply cap, which was checked only when tokens were minted through the normal deposit function, the attacker transferred THE straight to the vTHE contract, raising its exchange rate, then looped deposits, borrowing and buying. On-chain analyst EmberCN put the remaining bad debt at about $2.15 million, in CAKE and THE. Venus paused THE borrowing and withdrawals; Rekt and a community analysis on the Venus forum both date the start of the position to June 2025, about nine months earlier, when the attacker began building a THE deposit close to 84% of the 14.5 million supply cap.

The vector was not new. In the May 2023 Code4rena contest on Venus’s isolated pools, finding M-10, titled “Exchange Rate can be manipulated”, showed that sending tokens directly to a vToken inflates its exchange rate. A Venus representative disputed it, writing that the attack would be feasible “if we didn’t require an initial supply”, which Venus planned to require for new markets. A community analysis on the forum says the fix now checks the cap on every increase in balance, and the Liquidity Hub upgrade proposed on 12 November closes a similar gap by counting only tokens that the Hub’s own deposits and withdrawals produced.

29 October 2026: the Binance hack day

On the day of the Binance hack, BNB fell to $680. Venus’s October report says that day accounted for 59% of the month’s liquidated value, with 53 liquidations and $104,000 of collateral seized. Over the whole month there were 681 liquidations seizing $175,000 of collateral against $158,000 of debt repaid.

Audits and bug bounty

The security page of the documentation links more than 110 audit reports, each tied to a specific code revision in Venus’s GitHub repositories. Recent ones include HashDit on the Hub-funded spoke design (11 September 2026), on precision in the Hub’s collateral gateway (29 September 2026) and on the Hub’s price-deviation pause (16 October 2026), Bailsec and Sherlock on the spoke pools (both 23 October 2026), and Certik (19 September 2025) and Quantstamp (3 September 2025) on E-Mode. The Diamond Comptroller at the heart of the Core Pool was audited by Certik and OpenZeppelin in August 2023.

An audit covers the code it was shown, not the choice of collateral or its parameters. Most of Venus’s losses came from those choices. The security page lists audits only and gives no details of a bug bounty program, such as its platform or rewards.

Seven risks to weigh before using Venus

• Collateral that trades thinly can be pushed up and borrowed against: it happened with XVS in 2021, wUSDM in 2025 and THE in 2026.
• Prices rely on outside oracles; where no pivot source is set, the main price is used without a cross-check.
• Almost all deposits sit on BNB Chain, and the largest are BNB and BTCB, so a sharp fall in either moves the whole book.
• Stablecoin markets run at high utilisation (92.5% for USDC at the end of October), so lenders may wait to withdraw.
• Guardians can pause markets, and the documentation names neither them nor any multisig signers.
• Venus Labs, paid by the DAO, has no published legal entity, and XVS holders have no direct claim on fees.
• The Liquidity Hub and spoke pools with tokenized ETFs are new code, audited but young.

What to watch next

The first item is the vote on the 12 November proposal: the Liquidity Hub accounting change, the 105,000 USDC for Allez Labs, and the transfer of ownership of the PancakeSwap oracle on Ethereum, Arbitrum and Base, which an earlier proposal had missed. Then whether the Hub keeps growing past the $17.6 million it held at the end of October, and how the spoke markets for tokenized ETFs behave in their first volatile week. The November report should show whether the October sell-off left any bad debt behind. For context on the BNB Chain neighbours, see our pages on PancakeSwap and Aave, the largest lender overall.