An attacker spent 9 months building a position, bypassed @VenusProtocol supply cap via a known donation exploit, and extracted $3.7 million, leaving $2.15 million in bad debt on a protocol that has now been rekt four times in five years.