{"investigation":{"slug":"curve-dex","entity_name":"Curve Finance","trust_score":60,"severity_base":null,"score_modifier":24,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Curve Finance is a decentralized exchange and automated market maker (AMM) on Ethereum, operating since January 2020 and optimized for low-slippage swaps of stablecoins and other pegged assets. On July 30, 2023, a latent reentrancy flaw in the Vyper compiler (versions 0.2.15, 0.2.16 and 0.3.0) was exploited across several Curve pools, draining roughly $70 million; about 73% was later recovered or returned, and in December 2023 the Curve DAO voted to disburse about $49.2 million to affected liquidity providers. Separately, founder Michael Egorov's practice of borrowing large sums against CRV tokens created systemic risk for DeFi lending markets, ending in a roughly $140 million liquidation in June 2024 that left more than $10 million in bad debt, and a further liquidation in December 2024.","sections":[{"content":"Curve Finance was founded by Michael Egorov, a Russian physicist and entrepreneur who previously co-founded NuCypher, a privacy-focused infrastructure company. The protocol launched on Ethereum in January 2020 as a decentralized exchange liquidity pool designed for low-slippage, low-fee trading of stablecoins and similarly pegged assets. Its StableSwap invariant, written by Egorov, combines constant-sum and constant-product market-maker formulas to minimize slippage between price-pegged assets such as stablecoins and wrapped tokens, and became widely used across DeFi as a building block for stable-asset liquidity. Curve smart contracts are written in Vyper, a Python-like language for the Ethereum Virtual Machine. The CRV governance token and Curve DAO contracts were deployed in August 2020, initially by an anonymous community member (0xc4ad) rather than by the Curve team directly; the protocol is governed by CRV holders through the Curve DAO. In 2021 Curve launched Cryptoswap (Curve v2), extending its AMM design to volatile asset pairs, and expanded to Layer 2 networks and other Layer 1 chains including Polygon, Arbitrum, Avalanche and Fantom. By mid-2023 Curve was among the largest DeFi protocols by total value locked (TVL), with about $3.26 billion shortly before the July 2023 exploit. In 2023 it launched crvUSD, a decentralized stablecoin that uses a liquidation mechanism called LLAMMA (Lending-Liquidating AMM Algorithm), and later Curve Lend, a lending market.","heading":"Background","sources":[{"url":"https://www.gemini.com/cryptopedia/curve-finance-liquidity-provider-dao","name":"Gemini Cryptopedia: Curve Finance","type":"other","credibility":3},{"url":"https://resources.curve.finance/","name":"Curve Resources","type":"official","credibility":3},{"url":"https://defillama.com/protocol/curve-finance","name":"DefiLlama: Curve Finance","type":"other","credibility":3},{"url":"https://coinbureau.com/review/curve-finance-crv","name":"Coin Bureau: Curve Finance review","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2023/07/31/a-curve-founders-168m-stash-is-under-stress-creating-a-risk-for-defi-as-a-whole","name":"CoinDesk: A Curve founder's $168M stash is under stress","type":"news_article","credibility":3}],"severity":"low"},{"content":"The July 2023 exploit did not come from a flaw in Curve's own application logic but from a latent defect in the Vyper compiler. Vyper versions 0.2.15, 0.2.16 and 0.3.0 contained a broken implementation of reentrancy locks: the compiler allocated a separate storage slot for each @nonreentrant decorator it encountered, even when several decorators shared the same lock key. Contracts that used @nonreentrant guards across multiple functions therefore did not share a single lock state, which made cross-function reentrancy possible despite the developer's intent. The root cause traces to changes made in v0.2.13 to address an unrelated storage-slot collision; a later fix in v0.2.15 removed a guard that checked whether a nonreentrant key had already been given a storage slot, introducing the vulnerability. The defect went undetected from July 2021 until its exploitation on July 30, 2023. Vyper v0.3.1 corrected it by restoring key-based slot deduplication, but pools already deployed with the earlier versions remained vulnerable. The Vyper team published the official post-mortem on HackMD, and Chainalysis identified the affected compiler versions as the proximate cause.","heading":"Vyper compiler vulnerability: technical root cause","sources":[{"url":"https://hackmd.io/@vyperlang/HJUgNMhs2","name":"Vyper team post-mortem (HackMD)","type":"official","credibility":3},{"url":"https://www.certik.com/resources/blog/2qbPMcyJpR5UfoKrcjWxlQ-vyper-incident-anaylsis","name":"CertiK: Vyper incident analysis","type":"research","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","name":"Halborn: Explained: The Vyper bug hack (July 2023)","type":"research","credibility":3},{"url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","name":"Chainalysis: Curve Finance liquidity pool hack","type":"research","credibility":3}],"severity":"high"},{"content":"Beginning at about 9:30 AM ET on July 30, 2023, attackers exploited the Vyper reentrancy flaw across Curve pools that had been compiled with affected versions, hitting at least four pools in quick succession. In each case the attacker deposited tokens and then used the broken reentrancy lock to re-enter the contract during withdrawal, so balances were double-counted before state was updated; this distorted LP token price calculations and drained pool balances. JPEG'd's pETH/ETH pool (compiled with Vyper 0.2.15) lost about $11-12 million. Alchemix's alETH/ETH pool lost about $20 million ($17 million in ETH and $3 million in ERC-20 tokens). Metronome DAO's msETH/ETH pool lost about $1.6 million. Curve's own CRV/ETH pool was attacked twice, and additional CRV tokens were also taken. Reports differ on the CRV/ETH loss: about $18 million according to one account, $18-22 million across both attacks according to another. Estimates of total losses also vary: initial estimates put them at about $70 million, while other analysts put them at $69-73 million. It was one of the largest DeFi exploits of 2023.","heading":"July 2023 exploit: attack sequence and losses","sources":[{"url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","name":"Chainalysis: Curve Finance liquidity pool hack","type":"research","credibility":3},{"url":"https://hacken.io/discover/curve-finance-liquidity-pools-hack-explained/","name":"Hacken: Curve Finance liquidity pools hack explained","type":"research","credibility":3},{"url":"https://blockworks.co/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.co)","type":"news_article","credibility":3},{"url":"https://blockworks.com/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.com)","type":"news_article","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","name":"Halborn: Explained: The Vyper bug hack (July 2023)","type":"research","credibility":3},{"url":"https://cointelegraph.com/news/curve-vyper-exploit-whole-story-so-far","name":"Cointelegraph: Curve-Vyper exploit, the whole story so far","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/vyper-vulnerability-exposes-defi-ecosystem-stress-tests","name":"Cointelegraph: Vyper vulnerability exposes DeFi ecosystem stress tests","type":"news_article","credibility":3}],"severity":"critical"},{"content":"The exploit caused an immediate drop in Curve's usage. Accounts of the TVL decline differ slightly: one puts it at 47%, from $3.26 billion to about $1.73 billion within a day; CryptoSlate puts it at about 46%, from about $3.26 billion to $1.72 billion within 24 hours. On-chain data showed more than $1.58 billion in crypto assets withdrawn from Curve in the immediate aftermath. The CRV token fell more than 20-30% in the following days, reaching an intraday low of about $0.48. Secondary protocols that relied on CRV as collateral or as a liquidity incentive had to make emergency changes to risk parameters. TechCrunch wrote that the incident exposed systemic concentration risk in DeFi, particularly where a governance token serves at the same time as a collateral asset and as a liquidity gauge.","heading":"Market impact of the exploit","sources":[{"url":"https://cryptoslate.com/curve-finance-tvl-halved-following-vyper-vulnerability-exploit/","name":"CryptoSlate: Curve Finance TVL halved following Vyper vulnerability exploit","type":"news_article","credibility":3},{"url":"https://techcrunch.com/2023/08/01/curve-finances-62m-exploit-exposes-larger-issues-for-defi-ecosystem/","name":"TechCrunch: Curve Finance's $62M exploit exposes larger issues for DeFi ecosystem","type":"news_article","credibility":3},{"url":"https://blockworks.com/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.com)","type":"news_article","credibility":3},{"url":"https://blockworks.co/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.co)","type":"news_article","credibility":3},{"url":"https://www.coindesk.com/tech/2023/08/09/as-curve-averts-defi-death-spiral-fiasco-exposes-serious-risks","name":"CoinDesk: As Curve averts DeFi death spiral, fiasco exposes serious risks","type":"news_article","credibility":3}],"severity":"high"},{"content":"Several white-hat actors and MEV bot operators intervened during and after the attack. The pseudonymous operator c0ffeebabe.eth used MEV bots to front-run the attackers, recovering about $5.3 million from the CRV/ETH pool and about $1.6 million from the Metronome msETH pool, and returned both sums to the affected protocols. The attacker of Alchemix's alETH pool voluntarily returned about $12.7 million (4,820 alETH and 2,258 ETH) by August 8, 2023, and later returned further amounts, so that Alchemix was made fully whole. JPEG'd recovered about $10 million. Curve first offered the attackers a 10% bounty (about $7 million) if funds were returned by August 4, 2023. After that deadline passed without full compliance, Curve opened a public bounty of $1.85 million for information leading to the identification and conviction of any remaining exploiter. One attacker left an on-chain message saying: 'I'm refunding you not because you can find me, it's because I don't want to ruin your project.' By August 7, 2023, about 73% of the stolen funds (about $52.3 million) had been recovered or returned. Reports differ on the net loss that remained: about $18-20 million according to one account, $19-27 million according to another.","heading":"Fund recovery and bounties","sources":[{"url":"https://www.coindesk.com/tech/2023/08/07/curve-recoups-73-of-hacked-funds-bolstering-crv-sentiment","name":"CoinDesk: Curve recoups 73% of hacked funds","type":"news_article","credibility":3},{"url":"https://www.theblock.co/post/243464/curve-exploit-identity-bounty","name":"The Block: Curve exploit identity bounty","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/curve-hack-mev-bot-behind-61m-heist-begins-returning-funds","name":"Cointelegraph: MEV bot behind Curve heist begins returning funds","type":"news_article","credibility":3},{"url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","name":"Chainalysis: Curve Finance liquidity pool hack","type":"research","credibility":3},{"url":"https://cointelegraph.com/news/curve-vyper-exploit-whole-story-so-far","name":"Cointelegraph: Curve-Vyper exploit, the whole story so far","type":"news_article","credibility":3}],"severity":"medium"},{"content":"After the exploit, gauge emissions to the affected pools were suspended, and the developers deployed new pool implementations using corrected Vyper versions or alternative compilers, creating replacement alETH, msETH and pETH pools paired with WETH. On December 21, 2023, 94% of participating CRV holders approved a governance proposal to disburse about $49.2 million to liquidity providers hurt by the July 2023 hack, covering losses in the Curve CRV pool, Alchemix's alETH pool, JPEG'd's pETH pool and Metronome's msETH pool. The payout combined ETH recovered by white hats and forwarded to the DAO, distributed in full, with CRV tokens vested over time for the unrecovered portion. The two pages describe this structure in different units: about 5,919 ETH plus 34.7 million newly minted CRV according to one, and about $7.2 million in ETH plus about $42 million in CRV according to the other. The calculation also accounted for CRV emissions that affected LPs missed in the months after the hack.","heading":"Victim compensation and pool remediation","sources":[{"url":"https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims","name":"Cointelegraph: Curve Finance to disburse $49M compensation to hack victims","type":"news_article","credibility":3},{"url":"https://coingape.com/curve-finance-community-approves-49m-payout-for-july-hack-victims/","name":"CoinGape: Curve Finance community approves $49M payout for July hack victims","type":"news_article","credibility":3},{"url":"https://www.outlookmoney.com/cryptocurrency/sec-regrets-errors-related-to-crypto-firm-enforcement-case-curve-finance-to-disburse-49m-in-compensation-to-hack-victims","name":"Outlook Money: Curve Finance to disburse $49M in compensation to hack victims","type":"news_article","credibility":3},{"url":"https://hackmd.io/@LlamaRisk/BJzSKHNjn","name":"LlamaRisk (HackMD)","type":"research","credibility":3}],"severity":"medium"},{"content":"At the time of the exploit, founder Michael Egorov had borrowed about $100 million across several DeFi lending protocols, including Aave, Fraxlend, Abracadabra and Inverse Finance, collateralized almost entirely by CRV. He had pledged about 427.5 million CRV, nearly 47% of the circulating supply. His largest position was an approximately $63 million USDT loan on Aave V2, backed by about 34% of the total CRV supply, with a liquidation threshold of $0.3767 per CRV. Other positions included a $17-19 million loan on Fraxlend and an approximately $18 million loan on Abracadabra. The Fraxlend position was especially urgent because that platform's interest rate mechanism doubles the APY every 12 hours under stress, raising liquidation pressure regardless of price. Risk manager Gauntlet recommended that Aave DAO freeze CRV markets on Aave V2 to limit contagion. CoinDesk reported that a forced on-chain liquidation of such a concentrated position into thin liquidity could have crashed CRV further and set off cascading liquidations and bad debt at Aave, Abracadabra, Fraxlend and Inverse Finance at the same time. To shore up his positions, Egorov sold CRV over the counter at $0.40 per token, below the market price, in August 2023: about 106 million CRV to 53 investors for about $42 million ($42.4 million by another account). The sales came with a non-binding 'gentleman's agreement' that buyers would not sell before February 2024. Named buyers included Wintermute, Justin Sun (Tron), Jeffrey Huang (Machi Big Brother) and DW Labs. By late September 2023 Egorov had deposited $35 million in CRV to close his Aave position entirely, and the cascade was avoided. When the informal six-month lockup expired in February 2024, several OTC buyers moved CRV to exchanges and sold, pushing CRV below $0.40.","heading":"Founder's CRV-backed loans and the 2023 liquidation risk","sources":[{"url":"https://www.coindesk.com/markets/2023/07/31/a-curve-founders-168m-stash-is-under-stress-creating-a-risk-for-defi-as-a-whole","name":"CoinDesk: A Curve founder's $168M stash is under stress","type":"news_article","credibility":3},{"url":"https://finance.yahoo.com/news/curve-exploit-curve-founder-michael-081342185.html","name":"Yahoo Finance: Curve exploit and founder Michael Egorov's loans","type":"news_article","credibility":3},{"url":"https://www.coindesk.com/business/2023/08/03/curve-founder-still-owes-80m-despite-raising-nearly-30m-in-past-two-days","name":"CoinDesk: Curve founder still owes $80M","type":"news_article","credibility":3},{"url":"https://247wallst.com/investing/2023/08/01/curve-founder-sells-40m-in-crv-tokens-amid-liquidation-risk/","name":"247 Wall St: Curve founder sells $40M in CRV tokens amid liquidation risk","type":"news_article","credibility":3},{"url":"https://unchainedcrypto.com/curve-founders-liquidation-could-trigger-chaos-for-defi/","name":"Unchained: Curve founder's liquidation could trigger chaos for DeFi","type":"news_article","credibility":3},{"url":"https://www.theblock.co/post/243183/michael-egorov-has-sold-a-total-of-106-million-crv-for-42-million","name":"The Block: Michael Egorov has sold a total of 106 million CRV for $42 million","type":"news_article","credibility":3},{"url":"https://protos.com/curve-finance-gentlemans-agreement-expires-counterparties-dump-crv/","name":"Protos: Curve Finance gentleman's agreement expires","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/curve-finance-founder-100-million-debt-could-trigger-defi-implosion","name":"Cointelegraph: Curve founder's $100M debt could trigger DeFi implosion","type":"news_article","credibility":3}],"severity":"high"},{"content":"A second, more severe crisis came in June 2024. Between June 12 and 13, 2024, CRV fell about 24-30%, breaching Egorov's liquidation thresholds. His whole position, $95.7 million in stablecoin loans (mainly crvUSD) collateralized by about $141 million in CRV, was liquidated across five protocols: Inverse Finance, UwU Lend, Fraxlend, Curve's own LlamaLend and Aave. Two of Egorov's LlamaLend accounts produced more than $1 million in bad debt, and Curve Lend's total bad debt from the cascade was about $11.5 million. Egorov then sold 30 million CRV to Christian Seale of NextGen Venture Partners for $6 million USDT to clear the bad debt, which he said was fully repaid. A CRV slump in December 2024 triggered a further liquidation of Egorov's positions, which CoinDesk described as a repeat of the earlier episode.","heading":"Founder liquidations and bad debt (2024)","sources":[{"url":"https://decrypt.co/235149/curve-founder-liquidation-crv-token","name":"Decrypt: Curve founder liquidation","type":"news_article","credibility":3},{"url":"https://thedefiant.io/news/defi/curve-finance-founder-michael-egorov-suffers-massive-liquidations","name":"The Defiant: Curve founder Michael Egorov suffers massive liquidations","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/curve-finance-michael-egorov-bad-debt-llamma","name":"Cointelegraph: Egorov bad debt on LLAMMA","type":"news_article","credibility":3},{"url":"https://www.coindesk.com/business/2024/12/19/founder-of-de-fi-giant-curve-gets-liquidated-again-as-crv-slumps","name":"CoinDesk: Founder of DeFi giant Curve gets liquidated again as CRV slumps","type":"news_article","credibility":3}],"severity":"high"},{"content":"In May 2025 Curve suffered two off-chain security incidents. On May 5 its official X (formerly Twitter) account was compromised and used to promote a fraudulent CRV airdrop. On May 12 the curve.fi domain was hijacked at the DNS registrar level, sending visitors to a phishing site. Smart contracts were not affected in either incident, and the protocol processed over $400 million in on-chain volume while the frontend was unreachable. After the registrar attack, Curve moved its primary domain to curve.finance.","heading":"May 2025 X account compromise and DNS hijack","sources":[{"url":"https://news.curve.finance/curve-domain-incident/","name":"Curve News: Curve domain incident","type":"official","credibility":3},{"url":"https://www.vibraniumaudits.com/post/curve-finance-faces-dual-security-breaches-x-account-compromised-and-dns-hijack","name":"Vibranium Audits: Curve Finance faces dual security breaches","type":"research","credibility":3}],"severity":"high"},{"content":"After the exploit, Vyper released v0.3.1 with the reentrancy lock fix, and audit guidance began to stress checking the compiler versions of older deployments rather than reviewing source code alone. Curve keeps a public repository of security incident reports on GitHub (curvefi/security-incident-reports). Its newer pool contracts, StableSwap-NG and TriCrypto-NG, were not affected because they were compiled with patched Vyper versions. Researchers at Halborn and CertiK, among others, published post-mortems describing the incident as a previously underappreciated supply-chain risk: auditing source code is not enough if the compiler produces incorrect bytecode, so bytecode must also be verified. Curve has been audited by ChainSecurity, Quantstamp, StateMind and MixBytes, with ChainSecurity audits continuing through at least December 2024. In August 2025 Curve cut annual CRV inflation to 5.02%, removing about 22 million tokens a year of emissions pressure. TVL had recovered to about $2 billion by 2025, mostly on Ethereum, and Curve is reported to earn roughly 44% of DEX fee revenue on that network.","heading":"Security posture, audits and current status","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","name":"Halborn: Explained: The Vyper bug hack (July 2023)","type":"research","credibility":3},{"url":"https://www.certik.com/resources/blog/2qbPMcyJpR5UfoKrcjWxlQ-vyper-incident-anaylsis","name":"CertiK: Vyper incident analysis","type":"research","credibility":3},{"url":"https://hackmd.io/@vyperlang/HJUgNMhs2","name":"Vyper team post-mortem (HackMD)","type":"official","credibility":3},{"url":"https://github.com/curvefi/security-incident-reports","name":"GitHub: curvefi/security-incident-reports","type":"official","credibility":3},{"url":"https://resources.curve.fi/risks-security/security/","name":"Curve Resources: Security","type":"official","credibility":3},{"url":"https://hackmd.io/@LlamaRisk/BJzSKHNjn","name":"LlamaRisk (HackMD)","type":"research","credibility":3},{"url":"https://defillama.com/protocol/curve-finance","name":"DefiLlama: Curve Finance","type":"other","credibility":3},{"url":"https://coinbureau.com/review/curve-finance-crv","name":"Coin Bureau: Curve Finance review","type":"other","credibility":3}],"severity":"low"},{"content":"Curve's risk profile combines protocol, governance and founder-conduct risks. The July 2023 exploit showed that third-party compiler dependencies can introduce vulnerabilities that standard protocol audits do not catch. The risk is not unique to Curve, but here it was realized at scale. Egorov's multi-year practice of using CRV, the protocol's own governance and incentive token, as collateral for nine-figure stablecoin loans created a feedback loop: falling CRV prices threatened liquidation, liquidation would push CRV lower, and that could in turn weaken liquidity on Curve itself. This dynamic played out in 2023 and 2024 and created bad debt at several independent lending protocols. The informal 'gentleman's agreement' used to lock up OTC buyers in 2023 was non-binding and could not be enforced on-chain, which contributed to renewed selling when it expired. Analysts have also noted that crvUSD's collateral was overconcentrated in certain assets, including TUSD, which faced SEC enforcement action. As of the source reporting, no SEC, CFTC or DOJ action against Curve had been identified. The May 2025 incidents showed that off-chain attack paths remain exploitable, although smart contracts were not affected. Curve has been audited by several reputable firms, and its core AMM logic has not been compromised by an application-layer exploit, since the 2023 attack vector was a dependency flaw. The concentration of governance power and financial risk in a single founder's leveraged position remains a structural concern for users, liquidity providers and dependent protocols.","heading":"Risk assessment","sources":[{"url":"https://www.coinbase.com/institutional/research-insights/research/market-intelligence/curve-finance-exploit","name":"Coinbase Institutional: Curve Finance exploit","type":"research","credibility":3},{"url":"https://cointelegraph.com/news/curve-finance-founder-100-million-debt-could-trigger-defi-implosion","name":"Cointelegraph: Curve founder's $100M debt could trigger DeFi implosion","type":"news_article","credibility":3},{"url":"https://research.kaiko.com/insights/curve-finance","name":"Kaiko Research: Curve Finance","type":"research","credibility":3},{"url":"https://resources.curve.fi/risks-security/security/","name":"Curve Resources: Security","type":"official","credibility":3},{"url":"https://cryptorank.io/news/feed/9de9f-curve-dao-token-crv-price-prediction-2030-2","name":"CryptoRank: Curve DAO Token price prediction","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019-11","event":"Michael Egorov publishes the StableSwap whitepaper, setting out the AMM formula that became Curve Finance.","source":"Coin Bureau","source_url":"https://coinbureau.com/review/curve-finance-crv"},{"date":"2020-01","event":"Curve Finance launches on Ethereum mainnet as a stablecoin-optimized DEX.","source":"Gemini Cryptopedia","source_url":"https://www.gemini.com/cryptopedia/curve-finance-liquidity-provider-dao"},{"date":"2020-08","event":"CRV governance token and Curve DAO contracts deployed on August 13 by the anonymous community member 0xc4ad.","source":"Gemini Cryptopedia","source_url":"https://www.gemini.com/cryptopedia/curve-finance-liquidity-provider-dao"},{"date":"2021-06","event":"Curve v2 (Cryptoswap) launches, extending the AMM to volatile asset pairs.","source":"Coin Bureau","source_url":"https://coinbureau.com/review/curve-finance-crv"},{"date":"2021-07","event":"Vyper v0.2.15 is released, unintentionally introducing the reentrancy-lock storage-slot bug, which went undetected for two years.","source":"Vyper team post-mortem","source_url":"https://hackmd.io/@vyperlang/HJUgNMhs2"},{"date":"2021-11","event":"Vyper v0.2.16 and v0.3.0 are released, still carrying the reentrancy vulnerability.","source":"Vyper team post-mortem","source_url":"https://hackmd.io/@vyperlang/HJUgNMhs2"},{"date":"2022","event":"Vyper v0.3.1 fixes the reentrancy lock defect, but pools already deployed with earlier versions remain vulnerable.","source":"CertiK","source_url":"https://www.certik.com/resources/blog/2qbPMcyJpR5UfoKrcjWxlQ-vyper-incident-anaylsis"},{"date":"2023-07","event":"On July 30, attackers exploit Curve pools compiled with vulnerable Vyper versions: JPEG'd pETH/ETH (~$11-12M), Alchemix alETH/ETH (~$20M), Metronome msETH/ETH (~$1.6M) and Curve CRV/ETH (~$18-22M). Total losses are estimated at about $69-73 million.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/"},{"date":"2023-07","event":"On July 31, CRV falls more than 20% and Curve TVL drops from about $3.26B to about $1.72-1.73B. Egorov's $100M+ in CRV-backed loans are at risk of cascading liquidation, and Gauntlet recommends that Aave DAO freeze CRV markets.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2023/07/31/a-curve-founders-168m-stash-is-under-stress-creating-a-risk-for-defi-as-a-whole"},{"date":"2023-08","event":"Curve offers exploiters a 10% bounty if funds are returned by August 4. c0ffeebabe.eth returns about $5.3M from the CRV/ETH pool and about $1.6M from the Metronome pool.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/curve-hack-mev-bot-behind-61m-heist-begins-returning-funds"},{"date":"2023-08","event":"Michael Egorov sells about 106 million CRV over the counter at $0.40 per token (about $42-42.4 million) to 53 investors to reduce his loan exposure.","source":"The Block","source_url":"https://www.theblock.co/post/243183/michael-egorov-has-sold-a-total-of-106-million-crv-for-42-million"},{"date":"2023-08","event":"The August 4 bounty deadline passes without every exploiter returning funds. The Alchemix attacker begins returning funds voluntarily.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/08/07/curve-recoups-73-of-hacked-funds-bolstering-crv-sentiment"},{"date":"2023-08","event":"On August 6, Curve opens a $1.85 million public bounty for information leading to the identification and conviction of the remaining exploiters.","source":"The Block","source_url":"https://www.theblock.co/post/243464/curve-exploit-identity-bounty"},{"date":"2023-08","event":"By August 7, about 73% of stolen funds (about $52.3 million) have been recovered or returned, and the Curve DAO receives ETH recovered by white hats.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/08/07/curve-recoups-73-of-hacked-funds-bolstering-crv-sentiment"},{"date":"2023-08","event":"By August 8, the alleged Alchemix attacker has voluntarily returned about $12.7 million (4,820 alETH and 2,258 ETH).","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/"},{"date":"2023-09","event":"Egorov deposits $35 million in CRV to settle his Aave debt position in full.","source":"The Block","source_url":"https://www.theblock.co/post/243183/michael-egorov-has-sold-a-total-of-106-million-crv-for-42-million"},{"date":"2023-12","event":"On December 21, the Curve DAO votes 94% in favor of disbursing about $49.2 million in compensation to LPs in the CRV, alETH, pETH and msETH pools.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims"},{"date":"2024-02","event":"The informal six-month OTC lockup expires. Several OTC buyers sell CRV on exchanges, pushing the price below $0.40.","source":"Protos","source_url":"https://protos.com/curve-finance-gentlemans-agreement-expires-counterparties-dump-crv/"},{"date":"2024-06","event":"CRV falls about 24-30% over June 12-13. Egorov's entire CRV collateral position (about $141 million) is liquidated across Inverse, UwU Lend, Fraxlend, LlamaLend and Aave, leaving more than $10 million in bad debt on Curve Lend.","source":"Decrypt","source_url":"https://decrypt.co/235149/curve-founder-liquidation-crv-token"},{"date":"2024-06","event":"Egorov sells 30 million CRV for $6 million USDT to clear the LlamaLend bad debt and says it has been fully repaid.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/curve-finance-michael-egorov-bad-debt-llamma"},{"date":"2024-12","event":"A CRV slump triggers a further liquidation of Egorov's positions, according to CoinDesk.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/12/19/founder-of-de-fi-giant-curve-gets-liquidated-again-as-crv-slumps"},{"date":"2025-05","event":"On May 5, Curve's official X account is compromised and used to promote a fraudulent CRV airdrop phishing campaign.","source":"Vibranium Audits","source_url":"https://www.vibraniumaudits.com/post/curve-finance-faces-dual-security-breaches-x-account-compromised-and-dns-hijack"},{"date":"2025-05","event":"On May 12, the curve.fi domain is hijacked at the DNS registrar and visitors are redirected to a phishing site. Smart contracts are unaffected, and more than $400 million in on-chain volume is processed during the outage.","source":"Curve News","source_url":"https://news.curve.finance/curve-domain-incident/"},{"date":"2025-08","event":"Curve cuts annual CRV inflation to 5.02%, removing about 22 million tokens a year of emissions.","source":"LlamaRisk","source_url":"https://hackmd.io/@LlamaRisk/BJzSKHNjn"}],"sources_used":[{"url":"https://www.gemini.com/cryptopedia/curve-finance-liquidity-provider-dao","name":"Gemini Cryptopedia: Curve Finance","type":"other","archive_url":"http://web.archive.org/web/20251122111504/https://www.gemini.com/cryptopedia/curve-finance-liquidity-provider-dao","credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/curve-finance","name":"DefiLlama: Curve Finance","type":"other","archive_url":"http://web.archive.org/web/20251201022403/https://defillama.com/protocol/curve-finance","credibility":3,"archive_timestamp":null},{"url":"https://coinbureau.com/review/curve-finance-crv","name":"Coin Bureau: Curve Finance review","type":"other","archive_url":"http://web.archive.org/web/20260311134612/https://coinbureau.com/review/curve-finance-crv","credibility":3,"archive_timestamp":null},{"url":"https://resources.curve.finance/","name":"Curve Resources","type":"official","archive_url":"http://web.archive.org/web/20260225010335/https://resources.curve.finance/","credibility":3,"archive_timestamp":null},{"url":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","name":"Chainalysis: Curve Finance liquidity pool hack","type":"research","archive_url":"http://web.archive.org/web/20260508084821/https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","credibility":3,"archive_timestamp":null},{"url":"https://blockworks.co/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.co)","type":"news_article","archive_url":"http://web.archive.org/web/20260217213953/https://blockworks.co/news/curve-suffers-exploit","credibility":3,"archive_timestamp":null},{"url":"https://blockworks.com/news/curve-suffers-exploit","name":"Blockworks: Curve suffers exploit (blockworks.com)","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","name":"Halborn: Explained: The Vyper bug hack (July 2023)","type":"research","archive_url":"http://web.archive.org/web/20260516234919/https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/curve-vyper-exploit-whole-story-so-far","name":"Cointelegraph: Curve-Vyper exploit, the whole story so far","type":"news_article","archive_url":"http://web.archive.org/web/20260829130459/https://cointelegraph.com/news/curve-vyper-exploit-whole-story-so-far","credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims","name":"Cointelegraph: Curve Finance to disburse $49M compensation to hack victims","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://techcrunch.com/2023/08/01/curve-finances-62m-exploit-exposes-larger-issues-for-defi-ecosystem/","name":"TechCrunch: Curve Finance's $62M exploit exposes larger issues for DeFi ecosystem","type":"news_article","archive_url":"https://web.archive.org/web/20260829120148/https://techcrunch.com/2023/08/01/curve-finances-62m-exploit-exposes-larger-issues-for-defi-ecosystem/","credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2023/07/31/a-curve-founders-168m-stash-is-under-stress-creating-a-risk-for-defi-as-a-whole","name":"CoinDesk: A Curve founder's $168M stash is under stress","type":"news_article","archive_url":"http://web.archive.org/web/20260725154416/https://www.coindesk.com/markets/2023/07/31/a-curve-founders-168m-stash-is-under-stress-creating-a-risk-for-defi-as-a-whole","credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/post/243183/michael-egorov-has-sold-a-total-of-106-million-crv-for-42-million","name":"The Block: Michael Egorov has sold a total of 106 million CRV for $42 million","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/08/03/curve-founder-still-owes-80m-despite-raising-nearly-30m-in-past-two-days","name":"CoinDesk: Curve founder still owes $80M","type":"news_article","archive_url":"http://web.archive.org/web/20250831082501/https://www.coindesk.com/business/2023/08/03/curve-founder-still-owes-80m-despite-raising-nearly-30m-in-past-two-days","credibility":3,"archive_timestamp":null},{"url":"https://protos.com/curve-finance-gentlemans-agreement-expires-counterparties-dump-crv/","name":"Protos: Curve Finance gentleman's agreement expires","type":"news_article","archive_url":"http://web.archive.org/web/20260606140249/https://protos.com/curve-finance-gentlemans-agreement-expires-counterparties-dump-crv/","credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/235149/curve-founder-liquidation-crv-token","name":"Decrypt: Curve founder liquidation","type":"news_article","archive_url":"http://web.archive.org/web/20260512042124/https://decrypt.co/235149/curve-founder-liquidation-crv-token","credibility":3,"archive_timestamp":null},{"url":"https://thedefiant.io/news/defi/curve-finance-founder-michael-egorov-suffers-massive-liquidations","name":"The Defiant: Curve founder Michael Egorov suffers massive liquidations","type":"news_article","archive_url":"http://web.archive.org/web/20260409185336/https://thedefiant.io/news/defi/curve-finance-founder-michael-egorov-suffers-massive-liquidations","credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/curve-finance-michael-egorov-bad-debt-llamma","name":"Cointelegraph: Egorov bad debt on LLAMMA","type":"news_article","archive_url":"https://web.archive.org/web/20260829130354/https://cointelegraph.com/news/curve-finance-michael-egorov-bad-debt-llamma","credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/business/2024/12/19/founder-of-de-fi-giant-curve-gets-liquidated-again-as-crv-slumps","name":"CoinDesk: Founder of DeFi giant Curve gets liquidated again as CRV slumps","type":"news_article","archive_url":"http://web.archive.org/web/20250917190616/https://www.coindesk.com/business/2024/12/19/founder-of-de-fi-giant-curve-gets-liquidated-again-as-crv-slumps","credibility":3,"archive_timestamp":null},{"url":"https://hackmd.io/@LlamaRisk/BJzSKHNjn","name":"LlamaRisk (HackMD)","type":"research","archive_url":"http://web.archive.org/web/20260714094017/https://hackmd.io/@LlamaRisk/BJzSKHNjn","credibility":3,"archive_timestamp":null},{"url":"https://news.curve.finance/curve-domain-incident/","name":"Curve News: Curve domain incident","type":"official","archive_url":"http://web.archive.org/web/20260315172115/https://news.curve.finance/curve-domain-incident/","credibility":3,"archive_timestamp":null},{"url":"https://www.vibraniumaudits.com/post/curve-finance-faces-dual-security-breaches-x-account-compromised-and-dns-hijack","name":"Vibranium Audits: Curve Finance faces dual security breaches","type":"research","archive_url":"http://web.archive.org/web/20260519185417/https://vibraniumaudits.com/post/curve-finance-faces-dual-security-breaches-x-account-compromised-and-dns-hijack","credibility":3,"archive_timestamp":null},{"url":"https://resources.curve.fi/risks-security/security/","name":"Curve Resources: Security","type":"official","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinbase.com/institutional/research-insights/research/market-intelligence/curve-finance-exploit","name":"Coinbase Institutional: Curve Finance exploit","type":"research","archive_url":"http://web.archive.org/web/20250928110129/https://www.coinbase.com/institutional/research-insights/research/market-intelligence/curve-finance-exploit","credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/curve-finance-founder-100-million-debt-could-trigger-defi-implosion","name":"Cointelegraph: Curve founder's $100M debt could trigger DeFi implosion","type":"news_article","archive_url":"http://web.archive.org/web/20260829130436/https://cointelegraph.com/news/curve-finance-founder-100-million-debt-could-trigger-defi-implosion","credibility":3,"archive_timestamp":null},{"url":"https://research.kaiko.com/insights/curve-finance","name":"Kaiko Research: Curve Finance","type":"research","archive_url":"http://web.archive.org/web/20260124150742/https://research.kaiko.com/insights/curve-finance","credibility":3,"archive_timestamp":null},{"url":"https://cryptorank.io/news/feed/9de9f-curve-dao-token-crv-price-prediction-2030-2","name":"CryptoRank: Curve DAO Token price prediction","type":"other","archive_url":"https://web.archive.org/web/20260829183240/https://cryptorank.io/news/feed/9de9f-curve-dao-token-crv-price-prediction-2030-2","credibility":3,"archive_timestamp":null},{"url":"https://hackmd.io/@vyperlang/HJUgNMhs2","name":"Vyper team post-mortem (HackMD)","type":"official","archive_url":"http://web.archive.org/web/20260608171617/https://hackmd.io/@vyperlang/HJUgNMhs2","credibility":3,"archive_timestamp":null},{"url":"https://www.certik.com/resources/blog/2qbPMcyJpR5UfoKrcjWxlQ-vyper-incident-anaylsis","name":"CertiK: Vyper incident analysis","type":"research","archive_url":"http://web.archive.org/web/20250120164527/https://www.certik.com/resources/blog/2qbPMcyJpR5UfoKrcjWxlQ-vyper-incident-anaylsis","credibility":3,"archive_timestamp":null},{"url":"https://hacken.io/discover/curve-finance-liquidity-pools-hack-explained/","name":"Hacken: Curve Finance liquidity pools hack explained","type":"research","archive_url":"http://web.archive.org/web/20260307203702/https://hacken.io/discover/curve-finance-liquidity-pools-hack-explained/","credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/vyper-vulnerability-exposes-defi-ecosystem-stress-tests","name":"Cointelegraph: Vyper vulnerability exposes DeFi ecosystem stress tests","type":"news_article","archive_url":"https://web.archive.org/web/20260830171746/https://cointelegraph.com/news/vyper-vulnerability-exposes-defi-ecosystem-stress-tests","credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2023/08/07/curve-recoups-73-of-hacked-funds-bolstering-crv-sentiment","name":"CoinDesk: Curve recoups 73% of hacked funds","type":"news_article","archive_url":"https://web.archive.org/web/20260916005553/https://www.coindesk.com/tech/2023/08/07/curve-recoups-73-of-hacked-funds-bolstering-crv-sentiment","credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/post/243464/curve-exploit-identity-bounty","name":"The Block: Curve exploit identity bounty","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/curve-hack-mev-bot-behind-61m-heist-begins-returning-funds","name":"Cointelegraph: MEV bot behind Curve heist begins returning funds","type":"news_article","archive_url":"https://web.archive.org/web/20260830210107/https://cointelegraph.com/news/curve-hack-mev-bot-behind-61m-heist-begins-returning-funds","credibility":3,"archive_timestamp":null},{"url":"https://finance.yahoo.com/news/curve-exploit-curve-founder-michael-081342185.html","name":"Yahoo Finance: Curve exploit and founder Michael Egorov's loans","type":"news_article","archive_url":"https://web.archive.org/web/20260830210904/https://finance.yahoo.com/news/curve-exploit-curve-founder-michael-081342185.html","credibility":3,"archive_timestamp":null},{"url":"https://247wallst.com/investing/2023/08/01/curve-founder-sells-40m-in-crv-tokens-amid-liquidation-risk/","name":"247 Wall St: Curve founder sells $40M in CRV tokens amid liquidation risk","type":"news_article","archive_url":"http://web.archive.org/web/20251114083258/https://247wallst.com/investing/2023/08/01/curve-founder-sells-40m-in-crv-tokens-amid-liquidation-risk/","credibility":3,"archive_timestamp":null},{"url":"https://unchainedcrypto.com/curve-founders-liquidation-could-trigger-chaos-for-defi/","name":"Unchained: Curve founder's liquidation could trigger chaos for DeFi","type":"news_article","archive_url":"https://web.archive.org/web/20260830211727/https://unchainedcrypto.com/curve-founders-liquidation-could-trigger-chaos-for-defi/","credibility":3,"archive_timestamp":null},{"url":"https://cryptoslate.com/curve-finance-tvl-halved-following-vyper-vulnerability-exploit/","name":"CryptoSlate: Curve Finance TVL halved following Vyper vulnerability exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260512221020/https://cryptoslate.com/curve-finance-tvl-halved-following-vyper-vulnerability-exploit/","credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2023/08/09/as-curve-averts-defi-death-spiral-fiasco-exposes-serious-risks","name":"CoinDesk: As Curve averts DeFi death spiral, fiasco exposes serious risks","type":"news_article","archive_url":"https://web.archive.org/web/20260916005557/https://www.coindesk.com/tech/2023/08/09/as-curve-averts-defi-death-spiral-fiasco-exposes-serious-risks","credibility":3,"archive_timestamp":null},{"url":"https://coingape.com/curve-finance-community-approves-49m-payout-for-july-hack-victims/","name":"CoinGape: Curve Finance community approves $49M payout for July hack victims","type":"news_article","archive_url":"http://web.archive.org/web/20260830171412/https://coingape.com/curve-finance-community-approves-49m-payout-for-july-hack-victims/","credibility":3,"archive_timestamp":null},{"url":"https://www.outlookmoney.com/cryptocurrency/sec-regrets-errors-related-to-crypto-firm-enforcement-case-curve-finance-to-disburse-49m-in-compensation-to-hack-victims","name":"Outlook Money: Curve Finance to disburse $49M in compensation to hack victims","type":"news_article","archive_url":"http://web.archive.org/web/20251108222702/https://www.outlookmoney.com/cryptocurrency/sec-regrets-errors-related-to-crypto-firm-enforcement-case-curve-finance-to-disburse-49m-in-compensation-to-hack-victims","credibility":3,"archive_timestamp":null},{"url":"https://github.com/curvefi/security-incident-reports","name":"GitHub: curvefi/security-incident-reports","type":"official","archive_url":"https://web.archive.org/web/20260830172330/https://github.com/curvefi/security-incident-reports","credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-04T02:54:48.374866+00:00","updated_at":"2026-10-02T15:21:48.873923+00:00"},"source_quality":{"total":42,"tier1":0,"tier2":16,"tier3":0,"unrated":26},"follower_count":null,"content_updated_at":"2026-10-02T05:27:46.108Z","last_fact_checked_at":"2026-06-14T23:15:45.474Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}