Venus Protocol Reclaims $13.5M from Lazarus-Linked Phishing Attack

Venus Protocol successfully recovered $13.5 million stolen in a Lazarus Group–linked phishing attack that exploited a malicious Zoom client to gain delegated control over a user’s assets. After security partners HExagate and Hypernative flagged suspicious transactions, Venus paused its platform, performed an urgent audit, and confirmed no smart-contract or front-end breach. Within hours, an emergency governance vote forced liquidation of the attacker’s wallet, allowing the protocol to seize and transfer all stolen stablecoins and wrapped tokens to a recovery address in under 12 hours. Blockchain security firm SlowMist traced the exploit to North Korea–backed Lazarus Group, and specialists from Binance, PeckShield, and Venus coordinated closely on the operation. This swift, governance-driven response underscores Venus Protocol’s robust security measures and reinforces confidence in its decentralized lending services.