Venus Protocol Recovers $13.5 Million Stolen in Lazarus’ Phishing Attack
Venus Protocol, a leading DeFi lending platform, has successfully fought back against the Lazarus Group, one of the most feared state-backed hacker collectives in the crypto industry.
Venus helped a customer recover $13.5 million in stolen funds after the client fell victim to a phishing attack earlier this week, the firm announced via Twitter (X) on Thursday.
Hackers deployed a malicious Zoom client to trick the victim into granting delegated account access. Once inside, the attackers borrowed and redeemed assets, draining millions in stablecoins and wrapped tokens.
Emergency Vote Saves Millions
Venus Protocol’s community launched an on-chain governance vote in record time. The decision allowed them to force-liquidate the attacker’s wallet, sending the stolen tokens to a designated recovery address.
Hexagate and Hypernative, two blockchain security partners, flagged suspicious activity within minutes, prompting Venus to temporarily suspend the platform. Importantly, Venus confirmed that neither its smart contracts nor its front end were compromised.
The resolution took less than 12 hours, unusually fast for a DeFi hack.
The victim, Kuan Sun, narrowly avoided a catastrophic loss.
Supporting firms including PeckShield, Binance, and SlowMist also aided in the recovery effort.
Related : DeFi Trader Loses $13.5 Million in Crypto Phishing Attack on Venus Protocol
Lazarus Group Identified
Post-incident analysis by SlowMist confirmed the involvement of the Lazarus Group, a North Korea-sponsored hacking unit.
The group is notorious for high-profile attacks, including:
- The $600M Ronin Bridge exploit
- The $1.5B Bybit hack (2024)
SlowMist warned that Lazarus is increasingly deploying fake apps and phishing campaigns, including malicious Zoom clients, to expand their attack surface.
Why This Case Matters
Successful recovery of hacked funds in DeFi is extremely rare. Venus Protocol’s transparent governance, rapid decision-making, and cross-industry collaboration may set a new security benchmark for the sector.
The Lazarus Group remains one of the most dangerous threats to global crypto infrastructure, but this time, the attackers lost.
