Inside the Venus Protocol Exploit: How 9 Months of Patience and a Donation Attack Bypassed Supply Caps to Drain $3.7M

On March 15, 2026, Venus Protocol on BNB Chain lost $3.7M to an attacker who spent nine months accumulating ~84% of the vTHE supply cap, then used a donation attack—directly transferring tokens to the vToken contract—to bypass mint()-enforced supply caps and inflate their collateral's exchange rate to 3.7x the intended limit. The exploit highlights a fundamental flaw in Compound-forked lending protocols where direct ERC-20 transfers circumvent supply cap checks, and underscores the need for concentration risk monitoring, donation guards, and exchange-rate anomaly detection.