Venus Protocol Reclaims $13.5 Million After Wallet Hack

Venus Protocol Reclaims $13.5 Million After Zoom-Based Wallet Hack

Written by Aaron S.,

Editor-In-Chief

Last Updated: September 05, 2025

Key Takeaways

Venus Protocol recovered $13.5 million after a phishing scam tricked a user via a fake Zoom app;
Security firms flagged the theft early, which prompted Venus Protocol to pause the platform and act fast;
A governance vote allowed Venus Protocol to liquidate the attacker’s wallet and return funds within 12 hours.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

BITDEGREE IN YOUR SOCIAL FEED

On September 4, Venus Protocol successfully returned $13.5 million in cryptocurrency to a user whose wallet had been compromised in a phishing scheme linked to North Korea’s Lazarus Group.

The attack took place on September 2 and involved the use of a tampered Zoom application. After the victim unknowingly installed it, they were tricked into handing over control of their wallet.

After the transactions began, two of Venus Protocol’s security partners, Hypernative and HExagate, flagged the unusual activity. Their early warning allowed the platform to temporarily pause operations.

What is Terra Luna? History & Crash Explained (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Venus Protocol then checked its systems to make sure the issue did not come from within. The investigation confirmed that neither the protocol’s smart contracts nor its user interface had been altered or compromised.

To recover the stolen funds, Venus Protocol held an emergency governance vote. The outcome approved a forced liquidation of the attacker's wallet. This action allowed the platform to seize the stolen tokens and move them to a secure recovery wallet.

According to Venus, the full recovery, from detecting the suspicious behavior to transferring the funds, was completed in under 12 hours.

Kuan Sun, the victim of the phishing attack, later thanked the teams involved and said the outcome was a win in a situation that could have ended much worse.

On September 3, World Liberty Financial (WLFI) blacklisted compromised wallet addresses before its token launch. How? Read the full story.