By Rekt News

Compiled by: TechFlow

Click here to lose $13 million.

One of Venus Protocol’s whales just learned the hard way that a Zoom call can cost more than your mortgage.

A malicious video client, a perfectly timed signature, and $13 million gone faster than a rug pull announcement.

But here’s the twist – Venus didn’t just stand by and watch its users get emptied out.

They shut down their own protocol, called an emergency vote, and pulled off one of the most controversial rescue operations in DeFi in less than 12 hours.

What started out as a seemingly ordinary phishing attack turned into a fascinating masterclass in whether decentralized protocols can have their cake and eat it too.

When saving whales means exposing a kill switch hidden in the protocol, who is really being saved?

Source: Peckshield, Venus Protocol, Blocksec, Kuan Sun

On September 2nd, at 9:05 UTC, a Venus Protocol whale launched their Zoom client, ready to start a new day of DeFi business.

But seemingly innocent video software was quietly compromised, giving attackers backdoor access to their entire device.

Why crack the code? Wouldn't it be easier to just break the trust?

The victim signed a delegation authorization transaction - a routine permission operation that occurs thousands of times a day in DeFi.

Agreements that allow you to manage your positions without having to touch your private keys. These agreements are generally quicker to sign than to read the Terms of Service.

Click. Sign. Instant liquidation.

From signature to financial ruin, just six seconds.

A compromised video client handed over management of a wallet worth $13 million to an attacker who waited patiently for the opportunity.

Most phishing stories end here—the whale gets hurt, the attacker disappears, and Twitter taunts the victim for a week.

But this time, the thieves' plan was much more ambitious than a simple "robbery."

What happens when stealing millions of dollars isn't enough?

Theft Operation

09:05:36 UTC. Just six seconds after the whale signed their "crypto suicide agreement," the attacker launched a flash loan masterpiece.

Vulnerable transaction: 0x4216f924ceec9f45ff7ffdfdad0cea71239603ce3c22056a9f09054581836286

Venus Protocol’s post-mortem analysis detailed the attacker’s strategy:

Step 1: Flash Borrow 285.72 BTCB — After all, why use your own money? DeFi allows you to borrow millions without collateral.

Step 2: Use the borrowed funds to pay off the victim’s existing debts, while adding an additional 21 BTCB from the attacker’s own account. This may seem generous, but it is actually a cold-blooded “accounting murder.”

Step 3: Activate the delegated authority. Transfer all of the victim's digital assets—including $19.8 million worth of vUSDT, $7.15 million worth of vUSDC, 285 BTCB, and a long list of other tokens. All of this is completely legal, as the "naive" signature six seconds ago authorized it.

Step 4: A masterstroke. Using these newly stolen assets as collateral, the attacker borrowed $7.14 million in USDC against the victim's remaining BNB. Not only did the attacker empty their wallet, but they also made the victim pay for their "theft."

Step 5: Borrow enough BTCB to repay the flash loan. The transaction is completed and the attacker disappears.

One automated trade, one hollowed-out whale, and one very satisfied crypto thief – they had just turned someone else’s life savings into their own mortgage toy farm.

However, greed often turns the hunter into the hunted.

What happens when a "perfect theft" turns into a "suicide operation"?

Countermeasures

09:09 UTC. Four minutes after the digital bank heist, Hexagate and Hypernative's surveillance systems began sounding alarms.

This is no ordinary "suspicious transaction detected" prompt.

It was a $13 million, five-alarm incident, and the security company immediately knew who to contact.

Venus Protocol's response? Nuclear option.

From the theft to the suspension of the protocol, it took just twenty minutes. Venus activated their own kill switch, freezing all core functions of the entire ecosystem.

Borrowing? Stop. Withdrawal? Terminate. Liquidation? Pause.

One user got phished, and the entire protocol came to a halt.

This is more than just crisis management—it's a financial battle.

Venus decisively restricted its platform in an attempt to trap the stolen goods from the attackers.

Every vToken held by the hacker instantly became worthless paper, locked under Venus' emergency permissions.

But freezing the entire DeFi protocol to save a whale? Such a decision is not something the development team can make alone.

So, democracy comes into play: an emergency governance vote.

When the community only has twelve hours to decide whether to save a user’s wealth through centralized means, can you really call it decentralized?

Lightning Democracy

Venus not only suspended the protocol, but also convened an emergency "online meeting" that would make any Web2 crisis management team envious.

They called it a "flash vote."

After all, nothing says “grassroots governance” like compressing multi-million dollar decisions into a few hours of heated debate on Discord.

The proposal is simple and clear:

Phase 1: Partial restoration of functionality (allowing users to avoid liquidation).

Phase 2: Forced liquidation of the attacker’s positions.

Phase 3: Conduct a comprehensive safety review to prevent similar incidents from happening again.

Phase 4: Fully restore Venus's operations.

The community's response? 100% unanimous approval.

Not 99%. Not 98%.

Every vote supports Venus’s plan of action, like some kind of DeFi version of North Korean election results.

Maybe this is a real consensus, or maybe it's out of self-protection.

Or when your protocol is hemorrhaging millions of dollars and competitors are swarming you like vultures, disagreement becomes a luxury no one can afford.

By the afternoon, Venus was authorized.

What followed was the execution of one of the most controversial liquidations in DeFi history—an operation that required circumventing smart contract rules and forcibly seizing the attacker’s collateral.

Victims are in danger due to an erroneous transaction signature, and Venus is about to sign the "death certificate of democracy."

What happens when "code is law" meets emergency powers?

Recovery Operation

At 21:36 UTC, twelve hours after the theft, Venus carried out their counterattack.

Remember that greedy mistake the attacker made? Using stolen funds as collateral is about to become the most expensive blunder in history.

One transaction, multiple instructions, caused the greatest controversy.

Liquidation: Initiated. Asset Seizure: Completed. Liquidation: Closed.

Venus just performed surgery on a live blockchain, activated the kill switch, seized all unlocked assets, and destroyed all evidence.

The attacker’s “masterpiece” ultimately became their own death sentence. Did the stolen collateral sit safely in Venus’s pool?

Suddenly, the agreement’s newly activated “emergency liquidation” powers became fair game.

Greed is a poison. Steal millions, use them as collateral, and then be liquidated with your own stolen funds.

21:58 UTC. Lights restored. Funds recovered. Crisis resolved.

But no one was talking about the $13 million loss anymore. What was being discussed was how Venus had, in those 12 hours, proven that “decentralization” was just a marketing slogan.

It turns out your unstoppable DeFi protocol has a very unstoppable emergency brake — and they don’t hesitate to use it when the cost is high enough.

When the revolution needed a king to maintain it, who was being overthrown?

Victims speak out

“It is better to remain silent than to speak and remove all doubts, though you may be thought a fool.”

This is the Twitter profile of Kuan Sun, the founder of Eureka Crypto and the victim of the $13 million theft.

Speaking of "stupidity," he published a detailed retrospective explaining exactly how he was deceived.

Venus Protocol also confirmed that he was the victim of the phishing attack.

This kind of social engineering is extremely evil.

The attackers began their operation in April this year by hacking into a "Stack Asia BD" contact whom Sun Kuan met at a conference in Hong Kong.

Months of patient preparation, building trust through a familiar but not overly intimate relationship, had already provided the attacker with access to his device.

During the fake meeting: “Your microphone is not working, please upgrade.” This is another layered scam that conceals the attacker’s operations in the background.

Then, Chrome crashed unexpectedly. Click "Restore tabs?"

Somehow, his trusted Rabby Wallet extension had been replaced with a fake version that removed all security warnings.

Venus withdrew the money, just like he had done thousands of times before.

But this time, there were no risk warnings, no simulated transaction previews, and no security checks. The compromised front-end disguised an authorization operation as a normal transaction.

Hardware wallets don’t matter. Rabby’s security features don’t matter. When the frontend is poisoned, even the tightest security setup only provides a false sense of security.

To make matters worse, based on the victims’ recollections, the attack was allegedly carried out by the Lazarus Group, an elite North Korean hacking group that has been conducting terrorist activities in the cryptocurrency space for years.

This time he wasn't being lured in by some rookie, but was being precisely defeated by national-level digital warfare experts, who may have already perfected this attack process.

Now, he’s thanking Venus Protocol, PeckShield, SlowMist, Chaos Labs, Hexagate, HyperactiveLabs, Binance, and others for helping him recover his funds.

It’s a happy ending, thanks to a protocol willing to break its own rules when personal gain is involved.

When the world’s most sophisticated hackers can defraud hardware wallets and security-conscious users, is anyone in DeFi truly safe?

In one transaction, Venus saved the whales and shattered the dream of decentralization.

Twelve hours of coordinated chaos proved that behind every so-called "decentralized" protocol lies a centralized "panic button" masked by a governance mechanism.

Sure, the community voted — but when 100% consensus is reached faster than a Discord argument about gas fees, you’ve witnessed democracy’s greatest magic trick: making tyranny look like collective decision-making.

The attackers were left empty-handed, the whales recovered their wealth, and Venus demonstrated that they can overturn their own code at any time when faced with enormous digital pressure.

Mission accomplished, reputation ruined.

The real tragedy isn’t that someone fell for a Zoom phishing scam, but that the protocols we still pretend to have emergency powers are fundamentally different from the traditional financial system they purport to replace.

If decentralization dies once it becomes inconvenient, did it ever really exist?