As the most popular blockchain-based decentralized platform currently, decentralized finance (DeFi) constructs an open and transparent financial ecosystem. Due to its inherent openness, DeFi is also vulnerable to security threats such as transaction fraud. Although the existing detection methods for DeFi anomaly behavior can ensure the security of the DeFi system in certain specific application scenarios, they still suffer from limitations including high misjudgment and insufficient generalization ability. To avoid the above weaknesses, a hybrid model named VAE-BiLSTM is proposed for DeFi anomaly detection. The model integrates the dimensionality reduction ability of variational autoencoder (VAE) with the sequence modeling ability of bidirectional long short-term memory network (BiLSTM) to collaboratively capture of multi-modal anomaly behavior characteristics. Furthermore, the dynamic time warping and Bayesian optimization algorithm are employed to enhance the ability to detect anomaly behaviors. The experimental results show that the F1 score of the proposed model reaches 87%. Compared with the existing methods, the VAE-BiLSTM model exhibits stronger generalization ability and higher detection precision.