On March 15, 2026, an attacker drained $3.7M from Venus Protocol THE market on BSC by directly transferring THE tokens to inflate the exchange rate 3.81x, enabling massive borrowing. The attacker had spent 9 months accumulating 84% of the supply cap. The vulnerability was in getCashPrior() reading contract balance directly instead of tracking internal accounting.