- The Curve Finance protocol was hacked on Sunday, July 30, 2023. The attacker “zeroed out” several pools.
- The ones affected were those that ran on the Viper programming language’s smart contract.
- The exact damage is still being assessed. TVL of the project decreased by 44%. The situation has also affected the entire DeFi sector.
One of the largest decentralized exchange (DEX) Curve Finance has been hacked. The projected damage from the hacker’s actions is estimated to be between $41 million and $52 million. Other projects in the Vyper programming language are also at risk.
The information about the hack was confirmed by the administration of the platform. According to its statement, as well as the findings of the Vyper project team, the attacker exploited a “re-entry” vulnerability to gain access to the smart contract.
Curve Finance pools that use Viper versions 0.2.15, 0.2.16 and 0.3.0 were affected. In a comment for CoinDesk, a DEX team member under the pseudonym Mimaklas noted that other projects based on this smart contract are also at risk.
According to him, all the pools mentioned have been zeroed out and the exchange is still assessing the damage. Information on the amount of stolen funds varies.
Analysts of the BlockSec project cite a figure of $41 million, experts at PeckShield cite $52 million. The exchange’s TVL fell from $3.13 billion to $1.63 billion in just 24 hours, according to DefiLlama:
Curve’s TVL
The total TVL for the entire DeFi sector fell from $47.54 billion to $25.59 billion, according to DappRadar:
The total TVL for the entire DeFi sector
By the news, the CRV token fell more than 11% overnight to $0.65. At the moment, according to CoinMarketCap, the price was falling to the level of $0.6:
CRV/USD chart
Reminder, Curve Finance founder Mikhail Egorov was sued for disclosure of trade secrets, which led to financial losses. He and his wife had previously purchased a $41 million mansion in Melbourne.
In mid-June 2023, Egorov allegedly took out a $68 million loan from Aave Lender in mid-June 2023, secured by a CRV. The protocol’s founder still controls a third of the token’s entire supply.
Any possible unfavorable consequences for him could cause the exchange rate to collapse, Gauntlet said. Because of this, analysts at the organization have recommended that Aave freeze the deposit and reduce the LTV ratio to zero.
It will be interesting