Curio
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score was recalculated from the page's findings, 55 → 56. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -9.6 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Long-running | +2 |
| Regulated | +5 |
| Sum | 56 |
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 56/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-02 · 8 of 10 claims confirmed · 2 need better sources
anchored·hjYonJ…eV3CSummary
Curio (CurioDAO) is a multi-chain real-world asset (RWA) DeFi protocol that suffered a critical smart contract exploit on March 23, 2024, resulting in approximately $16 million in losses after an attacker exploited a voting-power privilege escalation vulnerability to mint approximately 1 billion unauthorized CGT governance tokens. The protocol had no known third-party security audits prior to the exploit and relied on internal reviews. Curio announced a recovery plan including a new CGT 2.0 token and a phased compensation program, though independent verification of full compensation delivery remains limited.
Connected Entities
4 entities · 60 linked investigations- Polkadot→mentioned with→Ethereum(65%)
- Binance→mentioned with→Ethereum(65%)
- Curio→mentioned with→Ethereum(70%)
- Curio→mentioned with→Polkadot(80%)
- Curio→mentioned with→Binance(65%)
Timeline(7 events)
23 March 2024
Exploit executed on Curio's Ethereum governance contract. Attacker acquires minimal CGT tokens, escalates voting privileges via IDSChief/IDSPause contracts, and mints approximately 1 billion unauthorized CGT tokens. Estimated loss: $16 million.
23 March 2024
CurioDAO Association publicly announces the exploit and halts emergency operations.
25 March 2024
Curio publishes official post-mortem identifying a permission access logic vulnerability in the MakerDAO-derived governance smart contract as the root cause.
25 March 2024
Multiple independent security firms (Hacken, Cyvers, Neptune Mutual, Halborn) publish technical analyses of the exploit, corroborating the attack vector.
25 March 2024
Curio announces recovery plan: CGT 2.0 token launch within 2 weeks, four-stage 90-day LP compensation in USDC/USDT, 10% treasury airdrop, and white hat bounty of 10% of recovered funds.
26 March 2024
Curio announces CGT 2.0 token publicly, pledging 100% restoration for pre-exploit CGT holders across all affected networks.
23 March 2025
Projected completion date of the four-stage, one-year compensation program. Independent verification of full delivery is not available in public sources.
Decision Log
- slot 464298237 · hash 7Xacv4nG5Ri7ZETBGtnMGHxiXusBosDLPrFBHkmw2ksm
- slot 464298232 · hash DJ45GzFKK2bvzt15qUKgLDwDLNfpR1iJWttT44WNUYZf
- slot 464298227 · hash 63GyUsWUXurJXEx3wTqS8NVYw2HVErX8oorL8mitUKTj
- slot 455369754 · hash 3XbhuUdJ8QGsW6VZuRNUxqdhSa4cDS1HFhSQtfDZa96L
- slot 420839271 · hash 22Lmw4zX2oLzviCqBeQQSPidr256HEKvRxUkC59mZyC6
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 6 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:34 AM
last updated: 11/2/2026, 12:44:25 AM
8 viewsavoid.net — verified advice for a post-truth world