Curve Finance Hack 2023 — $61M Exploit Analysis

A reentrancy vulnerability in Vyper compiler versions 0.2.15-0.3.0 allowed attackers to drain multiple Curve liquidity pools.

Details

• Date: 2023-07-30
• Amount Lost: $61,000,000
• Chain(s): Ethereum
• Category: DeFi
• Technique: Smart Contract Exploit
• Status: Partially Recovered
• Amount Recovered: $22,000,000

Full Description

Multiple Curve Finance pools built with Vyper versions 0.2.15 through 0.3.0 were found to have a malfunctioning reentrancy lock due to a compiler bug. Attackers exploited this in alETH/ETH, msETH/ETH, and pETH/ETH pools. The Curve team and white-hat hackers worked to front-run remaining vulnerable pools, recovering a significant portion.

Laundering Analysis

Proceeds split — some attackers cooperated with Curve team and returned funds for a 10% bounty. Remaining stolen ETH moved through Tornado Cash. The Curve DAO treasury was used to partially compensate affected LPs. c0ffeebabe.eth (white-hat) front-ran and returned a substantial amount.

Sources

• https://rekt.news/curve-vyper-rekt/
• https://curve.fi/#/ethereum/pools

Transaction Hashes

• 0xc8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse