Venus

Venus officially launched on November 24, 2020. Its BNB Chain market joined Compound-style algorithmic lending with Maker-style stablecoin minting: users supplied six initial assets, borrowed against collateral and could mint VAI. XVS rewards recruited liquidity while also distributing future governance power.

The attraction was composability. A supplier received vTokens, a borrower reused deposited value, and utilization moved interest rates without a loan desk. The same shared pool also carried assumptions from price feeds, collateral factors and large accounts into every depositor's risk.

Venus later expanded into Core and isolated markets on several chains. The separately promoted Isolated Pools product was retired, and the current registry marks every non-Core mainnet pool Legacy / exit-only. Its beacon-based contract family still powers Core markets outside BNB; only legacy BNB Core uses the older Diamond architecture.

On May 17–18, 2021, heavy XVS buying and a price reversal triggered cascading liquidations. Venus's own investigation said there was no code exploit, estimated roughly $77 million of protocol loss and denied insider trading. Claims of manipulation circulated outside that investigation, so intent remains an allegation rather than the confirmed outcome.

The balance-sheet damage was measurable. An October report recorded shortfall tied to 2,008 BTC and nearly 6,000 ETH on two accounts. September liquidation had repaid only 93.825 BTC, and the projected XVS required for recovery had grown from about 3.3 million to 4.48 million as price changed.

The response reached beyond repayment. Venus replaced leadership, separated shared Swipe resources, proposed lower collateral factors, and pushed toward independent risk work, deviation controls and multisig administration. A governance token originally emitted to grow borrowing became an asset sold to repair borrowing's losses.

On May 12, 2022, Chainlink's LUNA feed stopped at $0.107 while market price fell toward $0.01. Venus reported discovering the gap roughly four hours later and pausing through a PauseGuardian multisig around 15:15 UTC. Its initial shortfall estimate was about $14.2 million.

Venus then let users supply and repay while borrowing and liquidation stayed blocked before normal operation resumed. The promised remedy included monitoring, secondary feeds and individual-market fail-safes rather than assuming one oracle value could safely govern every action.

That lesson became visible in the Resilient Oracle architecture: main, pivot and fallback sources can be checked against bounds. It changes the failure path, not the nature of collateral lending; governance still chooses sources and limits, and extreme markets can outrun intervention.

New controls did not make every market equivalent. In March 2026, an attacker sent more than 36 million THE directly to a market, bypassing the mint supply cap, while thin liquidity helped distort price. The position borrowed about $14.9 million gross; after liquidation, the vToken exchange rate's 3.81-times jump left about $2.18 million of residual bad debt. The official analysis did not establish the attacker's net profit outside the observed on-chain wallets.

The fault sat in cash accounting: the market trusted its raw token balance, including unsolicited transfers. Venus proposed replacing that value with internalCash across chains and paused borrowing on non-BNB deployments while patching. A cap on normal deposits had not capped donations, so the repair changed the accounting primitive rather than merely lowering a parameter.

Canonical XVS has a different boundary. Its BNB contract fixed supply at exactly 30 million and exposes no mint, burn, blacklist or proxy upgrade. Yet the live owner can freeze or unfreeze transfers, approvals and delegation globally; it was unlocked at review. Destination-chain XVS uses bridge-controlled burn and mint; authorized TokenController roles can pause, blacklist addresses and set minter caps, while the owner can replace its Access Control Manager.

By May 2026, Venus reported the THE root cause patched and the resulting protocol bad debt repaid. Venus said the multisig would reopen vTHE withdrawals, while minting and borrowing would stay paused as the market wound down. That is an accounting and market-status outcome; the reviewed record does not show a blanket promise to compensate every user liquidation.

Today's control plane reflects those distinctions. Normal and fast timelocks, an Access Control Manager, guardians and risk stewards divide permissions; official deployment records say the Critical Timelock has no permissions after VIP-645. The risk fund is controlled capital rather than depositor insurance, and BNB shortfall auctions were paused at review.

Venus did not solve lending by making every asset safe. It changed the product so a market can be isolated, frozen, patched, repaid or retired without pretending those acts are automatic. XVS holders can vote when they lock tokens, but the decisive history lies in what governance actually chose to stop and repair.