Partnered With:

The Venus on BSC was stolen, is it really an inside job?

Read this article in 20 Minutes

Venus Insider believes that the liquidation of XVS, including the Cannon incident in January of this year, was all about the team.

Venus.IO Exploit -- An Inside Job

Originally written by Venus Insider

Source: Gyro Finance

Savage Ono

The translator's note: On May 19, the largest BSC lending platform Venus was exposed to a large liquidation, according to the community feedback, several large households in the hands of more than 3 million XVS (Venus), in the night before the crash, Large owners spent tens of millions of dollars in a very short period of time to drive the price of XVS from over $70 to $144, then borrowed thousands of BTCs and tens of thousands of ETH against the high price. The price of XVS quickly collapsed and XVS was liquidated, leaving the Venus platform with more than $100 million in bad debt.

Over the next few days, the Venus team announced a series of developments in their plans for the aftermath of the accident, including lowering collateral ratios and inviting more members into the liquidation process.

In the early hours of May 28, a Twitter account known as VenusInsider posted An article titled Venus.IO Exploit -- An Inside Job, which linked the XVS liquidation, including the Cannon incident in January, to the team, The article, with reasonable evidence, lists several large transfer operation records as well as the transfer association between the relevant address and the top up address of Binance Exchange. But the author also stresses that there is no need to be convinced by his conclusion, and suggests readers to VERIFY it on their own. After all, DON't TRUST, VERIFY, is the spirit of blockchain.

The following is the original text of the author, this article is translated, try to keep the original meaning of the author.

Update on 28 May:

After this article was published, the Venus team contacted me to discuss it and try to clarify my understanding. At this point, the questions I raised remain. I was told that in due course the Venus team would provide me with an update on the issues I had raised. If there are further developments, then this article will be updated/clarified as needed.

In this article, I will provide on-chain evidence that the Venus/Swipe team is directly related to the blockchain wallet associated with Cannon's initial token sales event and XVS account settlement event.

Hundreds of users suffered losses and liquidated due to a liquidity shortage of over $100 million due to problems with the XVS protocol. This is a direct result of the team's actions, the Venus protocol system allowed maximum borrowing after apparent manipulation of the price of XVS tokens on the Binance exchange. As a result, more than 2 million XVs were forced to liquidate.

Below is an intuitive flowchart outlining my most relevant findings, with the following sections providing direct links to blockchain transactions. You don't need to take my conclusions at face value. Check the information for yourself.

The Cannon wallet, the cleared XVS wallet, and the Venus/Swipe team's financial wallet all link directly to the same Binance Exchange deposit address.

Cannon Initial Token Sale Event

Immediately after Cannon completed the initial token sale on the Swipe app, the Swipe/Venus team listed CAN tokens on the Venus app with a 60% collateral factor.

A "pre-sale round buyer" is allowed to offer up to 45% of the illiquid CAN tokens in circulation as collateral to borrow up to 60% of the BTC and ETH. Since the currency was trading on Uniswap at a significant multiple of the IWO quote, the "presale round seller" borrowed about $70 million in BTC (2000 BTC) and $8 million in ETH (7000 ETH), Drunken the available liquidity of the protocol - Due to the extreme lack of liquidity of CAN tokens, the protocol is also exposed to serious risk of liquidation losses.

The customer then provides us with the original assets that he has withdrawn and we repackage them back to BSC so that the buyer can reduce his risk and we can get back Venus' lost liquidity.

However, as the dust settled, in fact despite the above claims, after the funds were "repaid", the Venus Protocol was still owed 4,000 ETH.

Evidence:

There are currently 3 VCAN holders left, the first 2 of which currently owe the Venus protocol, each owing over 2036 ETH at the time of this writing. According to the blog post above, both wallets are confirmed to belong to the same entity.

Provide CAN and through the wallet

0x33df7a7f6d44307e1e5f3b15975b47515e5524c0

BTC and ETH are borrowed and it is sent to the Binance Deposit Wallet

0 x164a03a5190357a998378da7ec7e882c090ad029.

This is a Binance Exchange deposit address, and you can see that there are regular consolidation transactions on this account to transfer funds to the Binance Hot Wallet. I will call this wallet "0x164... 029 Binance wallet ".

Although all the BTCs borrowed by this entity have been repaid, despite the above statement, only 3000 of the 7000 borrowed ETH have been returned and 4000 ETH remain outstanding. As of today, this debt has grown to over 4072 ETH, and although these funds have no hope of being repaid, interest is still being paid to other ETH providers on the agreement.

XVS Borrowing Wallet 0xEF... 7bf

For more than 100 days, the C7BF account has been monitored by the community. The Venus team set a borrowing limit of 450,000 XVs, and this account borrowed about 330,000 XVs. 3000XVS rewards are applied to the market every day, with 50% of the rewards going to lenders and 50% to borrowers. In other words, this account gets over 1000XVS per day. Soon, this account became one of the top XVS holders, providing over 1 million XVs.

The community constantly questioned the Venus/Swipe team as to why they allowed this situation to continue.

April 1 Venus Protocol AMA

Q: #AMA XVS lending is closed to a few people and has a crazy yield, what is Swipe doing in terms of dealing with this rate.

JL: It's a fundamental change that needs to happen in order to be consistent. At the moment, it is well known that market speed (which determines the rewards for each market) is divided between borrowers and suppliers. There is a borrowing limit, so no one can maliciously borrow a lot of XVS and make a proposal, they need to really get into the game, which means buying or earning it.

While XVS has high annual interest rates in the borrowing market due to security issues, security issues are now outweighing people who want a piece of the action. The lucky ones were early adopters, and they took advantage of the borrowing cap. This is a basis for FCFS. The good news is that almost all of them, especially the biggest one, from the data on the chain, are being recomposed back into the protocol.

On May 8th VIP-22 passed, raising the collateral factor on XVS (and others) from 60% to 80%.

May 18, wallet 0xef... 7BF received multiple XVS transfers from Binance Hot Wallet. The timing of these transfers coincides with the "pumping" of XVS tokens. Here are 0 xef... Filtered view of 7BF. The total amount of XVs received during the above "pumping" period was 912,219.95 XVs. All of this additional funding was provided to Venus to make 0xef... 7BF's XVS wallet has a balance of over 2 million XVs.

The pattern observed on the blockchain looks like this.

(1) Receive XVS transfer from Binance Hot Wallet

(2) Offer to Venus to increase the collateral

(3) Borrowing more BTC/ETH to a high account limit

(4) Transfer BTC out to Binance Exchange

And so on and so on

XVS-Busd trades K-line since May 18

Actions in the chain of https://bscscan.com/tokentxns?a=0xef044206db68e40520bfa82d45419d498b4bc7bf& p=76

Based on the above chart and on-chain screenshots (which Binance can further confirm), I strongly suspect that the funds taken out were used to continue to buy XVS, driving up the price. The above pattern was repeated within 2-3 hours, and the same trading pattern can also be observed on pages 76 and 77 of the trading history - a sample screenshot is shown above.

Once XVS is no longer actively purchased, the market will pull back, however this leads to 0xEF... The 7BF wallet became undersecured, and a chain of liquidation ensued.

Due to high XVS prices, 0xEF... 7BF was basically able to redeem its XVS at a price well above fair market value, including over 1,000 free tokens per day. When the dust settles, 0xEF... 7BF left no collateral but had less than 2000 BTCs of debt.

In from 0 xef... 7 after extracting BTC bf account, I found that they were sent to 0 x04ebe08a11eafa75c913465e2bcdd34b133f7ed1, arrived soon after this purse, the money is sent to the "0 x164... 029 Binance wallet ".

You can also see that on March 8th, 0xEF... 7BF directly to "0x164... 029 Binance Wallet "sent 27 BTCs. This was 53 days after the Cannon incident and 71 days before the XVS liquidation.

Therefore, in view of the above, we CAN directly link the CAN event to the XVS clearing event through alleged price manipulation. One question I would like to ask is why the Swipe team didn't take immediate steps to mitigate the risk when it was clear that there was a bad system actor, and that the wallet address was associated with the Venus protocol, when they should have terminated the relationship. Why is this blockchain address not receiving constant attention from the team?

It's associated with the Swipe/Venus team

A. XVS Repurchase and Burn

On April 26, VIP-16 approved a proposal to buy back and burn $3.5 million of XVS from the market. In the proposal, Venus/Swipe team asked to send money to 0 x74574937281b91cd708aba6522287b78b3243ee7.

Then, 2.5 million USDT is sent to "0x164... 029 Binance Wallet ". After 20 minutes, 31,979.9961 XVS is sent back and the token burn is over.

B. With deployer and 0xFE... 7bf wallet deal

It is understood that the wallet

0x733657b431a35f0283c33de0dd7fd293a8f1a15a

Funds were sent to the team's "Venus: Deployer "address on November 25, 2020. The Deployer address is where all Venus contracts are created.

Then it was observed that 77 days ago, the remaining assets in this wallet were sent to 0xEF... 7BF, established a direct link between the team's wallet and the accounts benefiting from XVS borrowing, and eventually cleared through alleged price manipulation.

C. Transactions from the SXP ecosystem wallet

It is observed that "0x164... 029 Binance Wallet "received a large SXP transfer. The total value is more than 120 million tokens.

The source of these transfers is "BSC: Token Hub". In Binance transfer is initiated on the Chain, all from the wallet bnb1rcq2vzuzzvw5unqfkwylt5r5wxks73tck0sf4s such as txid B34... 293.

On March 1, 2021, the wallet received 10 m from bnb1c8wmwh6yvv4w6v9df0yzt23w4r0wus5lqh58mj SXP. Then on April 15, it received more than 50m SXPs.

Bnb1c8wmwh6yvv4w6v9df0yzt23w4r0wus5lqh58mj initially received 120 million from coinage SXP address.

Take a look at the original SXP white paper, which Outlines the allocation of tokens as follows.

SXP original whitepaper - token allocation section

So Wallet * 8MJ is Ecosystem's reserve wallet for the Swipe team.

So I'm going to connect all the points here; The last question is one for which I have no logical explanation/answer. Given that the Cannon incident occurred on January 14, 2021, why did the swipe team send funds from the ecosystem reserve to the same Binance deposit address where the Cannon entity sent funds on April 15? On reflection, there is no plausible explanation other than that all these events were orchestrated burglaries.

In the end, it is community user money, not agreement money, that is missing, and so far, the amount of money missing is ~2000 BTC and ~10000 ETH.

Earlier today, the Venus team made the following update.

The first VGP proposal will address the system shortage of BTC and ETH.

If the information I recorded is correct, then this first proposal would transfer XVS from the Treasury in exchange for ETH and BTC that the team already owns -- no doubt at a discount.

I can't keep silent any longer. I call on CZ to intervene immediately to investigate and confirm my findings and remove this corrupt team.

supplement

0 x0c1e306d12c55d92f0c56e19ee86bbabb71642024d2bdec7a301dea6452973e1 is 0 xef purse... One of several deals where 7BF sold a lot of VAI below the peg price. Many communities have complained about the lack of hooks, and it seems insiders are partly to blame.

There was also a wallet that owed the protocol 5800+ETH and withdrew the last 1400ETH 15 seconds before the clearing began. I can't find a direct connection between this account and the others, and based on the timing and amount of XVS withdrawals, compared to the other accounts, it's hard for me to believe that it wasn't involved in some way.