Leaderboard
378All-time rank
Venus Core Pool
Mar 15, 2026
$3.7M
Lost
$3.7M
Recovered
$0
Net loss
$3.7M
Unrecovered0% recovered
81x, enabling massive borrowing. The attacker had spent 9 months accumulating 84% of the supply cap.
The vulnerability was in getCashPrior() reading contract balance directly instead of tracking internal accounting.
How the exploit worked
View reproducible PoCBorrowBehalf + Donation Attack.
Lost: 913,858.263360521396654198 CAKE + 1,972.530910582753621682 WBNB
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Donation Attack
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Mar 15, 2026Exploit executed — $3.7M drained via donation attack
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)