DeFi's First Major Win: $13.5M Stolen by Lazarus Fully Recovered

Venus Protocol, a decentralized finance (DeFi) lending platform, has successfully recovered $13.5 million in cryptocurrency from a user who fell victim to a phishing attack linked to North Korea’s Lazarus Group. The incident occurred on September 2, 2025, when attackers exploited a malicious Zoom client to deceive the victim into granting control over their account, enabling them to borrow and redeem funds on the victim’s behalf. This led to the draining of millions in stablecoins and wrapped assets, including wrapped Bitcoin, USD Coin, Tether, XRP, and Ethereum. Initial estimates suggested losses of $27 million, but after accounting for the user’s existing debts, the final amount stolen was confirmed to be $13.5 million [3].

The attack was swiftly detected by Venus Protocol’s security partners, HExagate and Hypernative, who flagged the suspicious transaction within minutes. This prompted the immediate pause of the platform to prevent further fund movement and allowed the team to initiate an emergency governance vote. The vote authorized the forced liquidation of the attacker’s wallet, enabling the recovery of the stolen tokens and their transfer to a secure recovery address. This marked the first major successful recovery using emergency governance powers in DeFi, showcasing the platform’s ability to act rapidly and decisively in a crisis [1].

Kuan Sun, the affected user, praised the collaborative efforts of Venus Protocol and its security partners, including PeckShield, Binance, and SlowMist, in recovering the funds. He described the incident as a “battle” and expressed gratitude for the support that turned what could have been a total disaster into a successful recovery [3]. SlowMist, a blockchain security firm, was among the first to trace the attack back to the Lazarus Group, a North Korea-backed hacking collective with a history of high-profile crypto heists, including the $600 million Ronin bridge exploit and the $1.5 billion Bybit hack [1].

The swift response by Venus Protocol and its partners significantly reduced the potential damage of the attack. The entire recovery process took less than 12 hours, a rapid timeline compared to traditional financial recovery mechanisms. While the XVS governance token initially dropped 10% following the news, it quickly regained its value as the successful recovery was confirmed, demonstrating the market’s renewed confidence in the platform’s security measures [3].

The incident highlights the ongoing challenges in DeFi security, particularly the growing sophistication of cyberattacks. Venus Protocol’s successful intervention serves as a benchmark for other platforms considering similar emergency response strategies. The attack method—using fake software to trick users—underscores the importance of user education and vigilance when handling digital assets. As the DeFi ecosystem continues to evolve, the balance between decentralization and security remains a critical area of focus [3].

Source: [1] Venus Protocol Recovers $13.5M in Phishing Attack (https://cointelegraph.com/news/venus-protocol-recovers-13-5m-stolen-phishing-attack) [2] Venus Recovers $13.5 Million From Lazarus-Linked Phishing ... (https://unchainedcrypto.com/venus-recovers-13-5-million-from-lazarus-linked-phishing-attack) [3] Venus Protocol Recovers $13.5 Million From Hackers (https://bravenewcoin.com/insights/venus-protocol-recovers-13-5-million-from-hackers) [4] Is Binance Safu? North Korea Just Stole $13.5M in XVS ... (https://finance.yahoo.com/news/binance-safu-north-korea-just-231600115.html)