In a shocking phishing attack, North Korean-connected cybercriminals hit a BNB crypto whale to steal $13.5M in Binance coins, and now the XVS price could be in question – here’s why.
A major Venus Protocol user lost about $13.5M on Sept. 1 after a phishing attack targeted their positions. On-chain data and security reports confirmed the attack. It happened at 3:26 PM UTC.
Venus Protocol paused operations immediately after the incident. The platform said its smart contracts were still secure, and investigations are ongoing.
Security firm Beosin first reported losses of over $27M. Later, PeckShield revised the number to $13.5M. The initial figure included the user’s debt position. PeckShield said, “Initial estimates were higher as we did not exclude the debt position.”
Yu Xian, founder of SlowMist, said the user’s hardware wallet itself was secure. But attackers compromised the browser extension linked to it.
This gave them borrowing and redemption access to the user’s Venus Protocol holdings without the owner knowing. The case shows that hardware wallets can still be exposed if connected software is vulnerable. Even secure storage can fail against careful social engineering.
Analysis shows the attack was planned and well-funded. Gas fees came from Monero (XMR) exchanges and other funds traced back to eXch, a dark web exchange linked to North Korean hackers.
Xian said the whale was specifically targeted and it wasn’t a broad attack. The Venus Protocol frontend was likely safe while the event raises concerns about state-backed actors using phishing to go after high-value DeFi users.
Venus Protocol paused the platform to protect the remaining assets. The team confirmed direct contact with the affected user, and they said resuming too soon could have put more funds at risk. The protocol focused on user security rather than restarting operations quickly.
DISCOVER: 20+ Next Crypto to Explode in 2025
According to Coinglass data, the market was mostly bullish between June and before the attack.
The positive and steady funding rate indicates that the XVS token is supported by the general trend of the derivatives traders primarily being geared towards making gains.
Although periods of bearishness were experienced, especially in mid-June, the general trend is that of a market with a long-term interest in long positions.
(Source – XVS Funding Rate, CoinGlass)
The XVS/USDT pair saw high volatility over the past 24 hours as XVS fell up to -9% after the attack, then partially recovered.
