{"investigation":{"slug":"convergence","entity_name":"Convergence","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Convergence (CVG) is an Ethereum-based DeFi yield-aggregation protocol built on top of Curve and Convex Finance. On August 1, 2024, an attacker exploited a missing input-validation check in the CvxRewardDistributor contract — introduced by a post-audit gas-optimization change — to mint 58 million CVG tokens and sell them for approximately $212,000, collapsing the token price by 99%. The protocol never recovered; following a community DAO vote, the team pivoted operations to a successor project called Tangent Finance (TGN).","sections":[{"content":"Convergence Finance (ticker: CVG) is an Ethereum-based DeFi protocol that functions as an agnostic yield-aggregation and governance-optimization layer built on top of Curve Finance and Convex Finance. The protocol allows users to convert supported tokens into Convergence-wrapped equivalents (cvgAssets), stake them to earn boosted rewards from the underlying protocols, and participate in governance. CVG is the native governance and rewards token. The protocol was co-founded by Oscar Yeung and Ivan Yeung, whose team was reported to be based in Hong Kong and to number more than 20 people at its peak. Oscar Yeung's background is described as being in tokenization and traditional-finance private equity; Ivan Yeung's background is described as spanning Security Token Offerings, smart contract development, and a prior role at an autonomous driving simulation startup. The protocol was audited four times prior to its exploit by Halborn, Sherlock (Contest #126), and Hats Finance (two separate competitions covering bonds/vesting and the Convex integration respectively).","heading":"Protocol Background","sources":[{"url":"https://www.coinbureau.com/review/convergence-finance/","name":"coinbureau.com","type":"other","credibility":3},{"url":"https://docs.cvg.finance/general-information/protocol-overview","name":"docs.cvg.finance","type":"other","credibility":3},{"url":"https://docs.cvg.finance/faq/audits","name":"docs.cvg.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 1, 2024, an attacker exploited a critical vulnerability in Convergence's CvxRewardDistributor smart contract. The root cause was a missing input-validation check in the claimMultipleStaking function: the team had removed the line of code that verified the staking contract address as part of a post-audit gas-optimization modification. Because the audited codebase contained that check, none of the four prior audits flagged the resulting gap. The attacker deployed a malicious contract replicating the function signature of claimCvgCvxMultiple and passed it as a parameter to claimMultipleStaking. This bypassed all access controls and allowed the attacker to mint 58 million CVG tokens — representing the entire remaining staking emission supply. Those tokens were immediately swapped on Curve liquidity pools for approximately 60 wrapped ETH (wETH) and 15,900 crvFRAX stablecoin, netting roughly $210,000–$212,000. An additional estimated $2,000 in unclaimed Convex staking rewards was also drained. The attacker's wallet address is 0x03560a9d7a2c391fb1a087c33650037ae30de3aa; the malicious contract is at 0xee45384d4861b6fb422dfa03fbdcc6e29d7beb69; the attack transaction hash is 0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9.","heading":"August 2024 Smart Contract Exploit","sources":[{"url":"https://www.coindesk.com/markets/2024/08/01/defi-protocol-convergence-hacked-cvg-token-plunges-99-on-curve","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/defi-protocol-convergence-removed-code-leading-to-212k-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://blockapex.io/convergence-finance-hack-analysis/","name":"blockapex.io","type":"other","credibility":3},{"url":"https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit had an immediate and irreversible impact on CVG's market value. Prior to the attack, CVG traded at approximately $0.12 with a fully diluted valuation of roughly $17 million. Within hours of the exploit, the token price collapsed 99% to approximately $0.0004 on Curve. Market capitalization fell to approximately $57,000. The token did not materially recover. The attacker converted the stolen tokens to ETH and routed approximately 65.8 ETH through Tornado Cash, an on-chain privacy mixer, in an apparent attempt to obscure the trail of funds. Convergence urged all users to immediately cease interacting with the protocol and withdraw any remaining staked assets.","heading":"Token Impact and Market Consequences","sources":[{"url":"https://www.coindesk.com/markets/2024/08/01/defi-protocol-convergence-hacked-cvg-token-plunges-99-on-curve","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/08/02/hacker-steals-210000-in-cvg-tokens-from-convergence/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://coinjournal.net/news/defi-protocol-convergence-hit-by-major-hack-cvg-token-collapses/","name":"coinjournal.net","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 6, 2024, approximately five days after the exploit, Convergence Finance transmitted an on-chain message to the attacker's Ethereum address. The message read in part: 'Hey, Convergence Finance would like to discuss with you about the bug you found and successfully exploited on August 1st. Congratulations on identifying it.' The team stated they believed the attacker acted as a white hat and requested the return of the 65.8 ETH routed through Tornado Cash, providing a contact email and a designated return address. The message warned that if no response was received within 48 hours, the team would 'move to a new step.' No public confirmation of a response from the attacker or return of funds has been reported. The protocol also published an official post-mortem authored under the alias 'Wireshark,' accepting full responsibility for the post-audit code change. The team confirmed that non-CVG user funds (external staked assets) were not at risk from the exploit itself.","heading":"Team Response and Attacker Negotiations","sources":[{"url":"https://www.cryptotimes.io/2024/08/07/convergence-finance-sends-negotiation-message-to-hacker/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/65292-post-mortem-convergence-defi-protocol-hack","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The Convergence exploit illustrates a recognized class of DeFi vulnerability: post-audit code modification. The protocol had completed four audits — conducted by Halborn, Sherlock (Contest #126), and Hats Finance (two competitions) — yet none of these audits covered the specific code that was later modified. The team introduced the vulnerability after audits were completed during a gas-optimization pass, removing a single input-validation line from the claimMultipleStaking function without triggering a re-audit of the affected contract. This pattern — where audited code is modified for optimization without subsequent security review — was the direct cause of the $212,000 loss. Security researchers at BlockApex, SolidityScan, and Altcoin Buzz each independently documented the root cause as the missing validation line. The incident highlights the insufficiency of treating audits as a one-time gate rather than as an ongoing process applied to all code changes before deployment.","heading":"Audit Failures and Operational Security Concerns","sources":[{"url":"https://blockapex.io/convergence-finance-hack-analysis/","name":"blockapex.io","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/convergence-finance-hack-analysis-12e6acd9ea08/","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://www.altcoinbuzz.io/cryptocurrency-news/convergence-defi-protocol-hit-by-210k-exploit/","name":"altcoinbuzz.io","type":"other","credibility":3},{"url":"https://docs.cvg.finance/faq/audits","name":"docs.cvg.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the Convergence team opened a community DAO vote on the protocol's future. Two options were presented: (1) a Redemption path in which the protocol's on-chain treasury (~$353,000 in assets) would be liquidated to distribute partial compensation to CVG holders and seed investors (estimated at 5–7 cents per dollar invested for seed participants); or (2) a transition to a new project called Tangent, retaining ~$510,000 in assets to fund development. Over 97% of participating DAO voters chose the Tangent path. Tangent Finance (TAN) is described as a DeFi lending protocol on Ethereum, allowing users to borrow a stablecoin ($USG) against LP positions, with a fixed supply of 10 million TAN tokens. Functional Convergence products (cvgSDT, sdTKN booster, cvgCVX after re-audit) were slated for incorporation into Tangent's product suite. CVG holders who did not participate in the Tangent migration received no cash compensation under this outcome.","heading":"Protocol Wind-Down and Successor Project","sources":[{"url":"https://medium.com/cvgfinance/vote-for-convergences-future-c66a690ecae0","name":"medium.com","type":"other","credibility":3},{"url":"https://airdropalert.com/airdrops/tangent-finance/","name":"airdropalert.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Convergence Finance has been flagged by on-chain investigator ZachXBT. The specific nature and date of ZachXBT's flag are not independently verifiable from publicly archived sources at the time of this investigation. The flag is consistent with ZachXBT's documented pattern of surfacing protocols where post-exploit fund routing through Tornado Cash and the effective destruction of a governance token raises concerns about the incident's characterization and the adequacy of investor disclosures. The routing of exploit proceeds through Tornado Cash — an OFAC-sanctioned mixer as of August 2022 — adds a regulatory-compliance dimension to the incident beyond the technical exploit itself. Users should treat claims of white-hat intent without verified fund return as unconfirmed.","heading":"ZachXBT Flag and Community Intelligence","sources":[{"url":"https://www.coindesk.com/markets/2024/08/01/defi-protocol-convergence-hacked-cvg-token-plunges-99-on-curve","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023","event":"Convergence Finance (CVG) protocol launches on Ethereum, operating as a Curve/Convex yield-aggregation layer.","source":"","date_original":"2023-01-01"},{"date":"2024","event":"Protocol completes four separate smart contract audits (Halborn, Sherlock Contest #126, Hats Finance x2) prior to the exploit.","source":"","date_original":"2024-01-01"},{"date":"2024-08","event":"Attacker (0x03560a9d7a2c391fb1a087c33650037ae30de3aa) exploits missing input validation in CvxRewardDistributor, minting 58 million CVG tokens and selling them for approximately $212,000. CVG price collapses 99% on Curve liquidity pools.","source":"","date_original":"2024-08-01"},{"date":"2024-08","event":"Convergence team issues urgent public warning to cease all protocol interaction. Stolen ETH (~65.8 ETH) routed through Tornado Cash.","source":"","date_original":"2024-08-01"},{"date":"2024-08-02","event":"Official post-mortem published by Wireshark (Convergence alias), accepting full responsibility for the post-audit code change.","source":""},{"date":"2024-08-06","event":"Convergence transmits on-chain message to attacker, characterizing the exploit as possible white-hat activity and requesting return of 65.8 ETH within 48 hours. No confirmed response from attacker.","source":""},{"date":"2024-08-07","event":"Convergence Finance negotiation message to hacker publicly reported. No fund recovery confirmed.","source":""},{"date":"2024-09","event":"Community DAO vote opened on protocol future: Redemption (partial refund) vs. Tangent (successor project). Over 97% of participating votes favor the Tangent transition.","source":"","date_original":"2024-09-01"},{"date":"2024-10","event":"Convergence team announces pivot to Tangent Finance (TAN), a new DeFi lending protocol. CVG token deprecated. No cash compensation issued to CVG holders under the Tangent path.","source":"","date_original":"2024-10-01"}],"sources_used":[{"url":"https://www.coinbureau.com/review/convergence-finance/","name":"coinbureau.com","type":"other","archive_url":"http://web.archive.org/web/20260313052254/https://coinbureau.com/review/convergence-finance","credibility":3,"archive_timestamp":"2026-03-13T05:22:54+00:00"},{"url":"https://docs.cvg.finance/general-information/protocol-overview","name":"docs.cvg.finance","type":"other","archive_url":"http://web.archive.org/web/20260515233315/https://docs.cvg.finance/general-information/protocol-overview","credibility":3,"archive_timestamp":"2026-05-15T23:33:15+00:00"},{"url":"https://docs.cvg.finance/faq/audits","name":"docs.cvg.finance","type":"other","archive_url":"http://web.archive.org/web/20260515234515/https://docs.cvg.finance/faq/audits","credibility":3,"archive_timestamp":"2026-05-15T23:45:15+00:00"},{"url":"https://www.coindesk.com/markets/2024/08/01/defi-protocol-convergence-hacked-cvg-token-plunges-99-on-curve","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260322055933/https://www.coindesk.com/markets/2024/08/01/defi-protocol-convergence-hacked-cvg-token-plunges-99-on-curve","credibility":3,"archive_timestamp":"2026-03-22T05:59:33+00:00"},{"url":"https://cointelegraph.com/news/defi-protocol-convergence-removed-code-leading-to-212k-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260416020808/https://cointelegraph.com/news/defi-protocol-convergence-removed-code-leading-to-212k-hack","credibility":3,"archive_timestamp":"2026-04-16T02:08:08+00:00"},{"url":"https://blockapex.io/convergence-finance-hack-analysis/","name":"blockapex.io","type":"other","archive_url":"http://web.archive.org/web/20260606143202/https://blockapex.io/convergence-finance-hack-analysis/","credibility":3,"archive_timestamp":"2026-06-06T14:32:02+00:00"},{"url":"https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260724211715/https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0","credibility":3,"archive_timestamp":"2026-07-24T21:17:15+00:00"},{"url":"https://www.cryptotimes.io/2024/08/02/hacker-steals-210000-in-cvg-tokens-from-convergence/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20251009224321/https://www.cryptotimes.io/2024/08/02/hacker-steals-210000-in-cvg-tokens-from-convergence/","credibility":3,"archive_timestamp":"2025-10-09T22:43:21+00:00"},{"url":"https://coinjournal.net/news/defi-protocol-convergence-hit-by-major-hack-cvg-token-collapses/","name":"coinjournal.net","type":"other","archive_url":"https://web.archive.org/web/20260829125510/https://coinjournal.net/news/bitcoin-falls-to-62k-as-crypto-mirrors-stocks-crash/?dynamic","credibility":3,"archive_timestamp":"2026-08-29T12:55:10+00:00"},{"url":"https://www.cryptotimes.io/2024/08/07/convergence-finance-sends-negotiation-message-to-hacker/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829151230/https://www.cryptotimes.io/2024/08/07/convergence-finance-sends-negotiation-message-to-hacker/","credibility":3,"archive_timestamp":"2026-08-29T15:12:30+00:00"},{"url":"https://cryptorank.io/news/feed/65292-post-mortem-convergence-defi-protocol-hack","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829235719/https://cryptorank.io/news/feed/65292-post-mortem-convergence-defi-protocol-hack","credibility":3,"archive_timestamp":"2026-08-29T23:57:19+00:00"},{"url":"https://blog.solidityscan.com/convergence-finance-hack-analysis-12e6acd9ea08/","name":"blog.solidityscan.com","type":"other","archive_url":"https://web.archive.org/web/20260829124712/https://blog.solidityscan.com/convergence-finance-hack-analysis-12e6acd9ea08/","credibility":3,"archive_timestamp":"2026-08-29T12:47:12+00:00"},{"url":"https://www.altcoinbuzz.io/cryptocurrency-news/convergence-defi-protocol-hit-by-210k-exploit/","name":"altcoinbuzz.io","type":"other","archive_url":"http://web.archive.org/web/20250906162648/https://www.altcoinbuzz.io/cryptocurrency-news/convergence-defi-protocol-hit-by-210k-exploit/","credibility":3,"archive_timestamp":"2025-09-06T16:26:48+00:00"},{"url":"https://medium.com/cvgfinance/vote-for-convergences-future-c66a690ecae0","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://airdropalert.com/airdrops/tangent-finance/","name":"airdropalert.com","type":"other","archive_url":"https://web.archive.org/web/20260829123824/https://airdropalert.com/airdrops/tangent-finance/","credibility":3,"archive_timestamp":"2026-08-29T12:38:24+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:30.246239+00:00","updated_at":"2026-08-30T01:16:25.903767+00:00"}}