← Curve Financereviewed 2026-10-17 · 38 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Curve Finance against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 1unverifiable 1link rot 5partially supported 5confirmed 266 corrections pending · 0 applied
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #20[disputed][awaiting moderator]in section: Founder's CRV-backed loans and the 2023 liquidation risk
“Named buyers included Wintermute, Justin Sun (Tron), Jeffrey Huang (Machi Big Brother) and DW Labs.”
reviewerEgorov sold about 106 million CRV over the counter at $0.40/token (~$42 million) to 53 investors in August 2023, including named buyers Wintermute, Justin Sun, Jeffrey Huang (Machi Big Brother) and 'DW Labs'The firm is DWF Labs, not 'DW Labs' -- the page appears to have dropped the 'F'. Wintermute, Justin Sun and Jeffrey Huang are independently corroborated as buyers in the cited Block article.Proposed correction (not yet applied)Named buyers included Wintermute, Justin Sun (Tron), Jeffrey Huang (Machi Big Brother) and DWF Labs.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #21[unverifiable][awaiting moderator]in section: Founder's CRV-backed loans and the 2023 liquidation risk
“The sales came with a non-binding 'gentleman's agreement' that buyers would not sell before February 2024.”
reviewerEgorov sold 106 million CRV to 53 investorsNote: quoted_text above is a nearby exact sentence used only to anchor location, since the specific '53 investors' figure itself (appearing in 'about 106 million CRV to 53 investors for about $42 million') could not be matched to any source found; no source consulted states an exact buyer count of 53. Treat as an unverifiable precise figure, not necessarily false.
link rot
5 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #34[link rot][awaiting moderator]in section: Victim compensation and pool remediation
“https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims”
reviewerDead citation: Cointelegraph article on the $49M compensation voteThe underlying claim (Dec 2023 vote, 94%, $49.2M) is well supported elsewhere; this finding concerns only the dead URL.Proposed correction (not yet applied)https://coingape.com/curve-finance-community-approves-49m-payout-for-july-hack-victims/ - #35[link rot][awaiting moderator]in the cited sources
“https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims”
reviewerDead citation: Cointelegraph article on the $49M compensation vote (duplicate occurrence)Same underlying defect as the sections[5].sources[0] occurrence; grouped together.Proposed correction (not yet applied)https://coingape.com/curve-finance-community-approves-49m-payout-for-july-hack-victims/ - #36[link rot][awaiting moderator]in section: July 2023 exploit: attack sequence and losses
“https://blockworks.com/news/curve-suffers-exploit”
reviewerDead/duplicate citation: blockworks.com version of the Curve exploit article (exploit section)Safe to drop since the identical article is already cited via the working .co domain in the same sources list. - #37[link rot][awaiting moderator]in section: Market impact of the exploit
“https://blockworks.com/news/curve-suffers-exploit”
reviewerDead/duplicate citation: blockworks.com version of the Curve exploit article (market impact section)Same underlying defect; grouped with the other blockworks.com occurrences. - #38[link rot][awaiting moderator]in the cited sources
“https://blockworks.com/news/curve-suffers-exploit”
reviewerDead/duplicate citation: blockworks.com version of the Curve exploit article (top-level sources_used)Same underlying defect; grouped with the other blockworks.com occurrences.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #10[partially supported][awaiting moderator]in section: July 2023 exploit: attack sequence and losses
“Estimates of total losses also vary: initial estimates put them at about $70 million, while other analysts put them at $69-73 million.”
reviewerTotal losses from the July 2023 exploit were estimated at about $69-73 million (roughly $70 million)The $69-73M range is well supported by Chainalysis/Hacken, but early reporting (first 24-48 hours) cited much lower figures ($47M, then $61-62M) before the tally stabilized near $70M; the page's hedged framing is reasonable but doesn't surface how much the early estimates diverged. - #12[partially supported][awaiting moderator]in section: Market impact of the exploit
“The CRV token fell more than 20-30% in the following days, reaching an intraday low of about $0.48.”
reviewerCRV fell more than 20-30% in the days after the exploit, reaching an intraday low of about $0.48Only one source found states exactly $0.48, and other contemporaneous reports cite different price points ($0.545, $0.649); the decline direction and rough magnitude are right, but the specific $0.48 figure rests on thin, single-source support. - #25[partially supported][awaiting moderator]in section: Founder liquidations and bad debt (2024)
“Two of Egorov's LlamaLend accounts produced more than $1 million in bad debt, and Curve Lend's total bad debt from the cascade was about $11.5 million.”
reviewerCurve Lend's total bad debt from the June 2024 cascade was about $11.5 million, with two of Egorov's LlamaLend accounts producing more than $1 million of itThe $11.5M figure is a real, sourced initial estimate (Saint Rat), but it is not the only number in circulation -- $10M (Egorov's own figure, repeated by Cointelegraph) is at least as commonly cited for the same total. The page presents $11.5M without flagging this variance, unlike its practice elsewhere of hedging between competing figures. - #27[partially supported][awaiting moderator]in section: Founder liquidations and bad debt (2024)
“A CRV slump in December 2024 triggered a further liquidation of Egorov's positions, which CoinDesk described as a repeat of the earlier episode.”
reviewerA CRV slump in December 2024 triggered a further liquidation of Egorov's positions, described by CoinDesk as a repeat of the earlier episodeTrue but potentially misleading by omission: the December 2024 liquidation was for roughly $882,000 in CRV (per PeckShield, following a 12% CRV drop), nearly two orders of magnitude smaller than the ~$140M June 2024 episode, and Egorov described the liquidated tokens as receipts tied to the UwU Lend hack rather than a fresh systemic-risk event. The page's wording is literally accurate ('a further liquidation') but the juxtaposition with the June episode in the same section/summary risks implying comparable severity. - #31[partially supported][awaiting moderator]in section: Security posture, audits and current status
“TVL had recovered to about $2 billion by 2025, mostly on Ethereum, and Curve is reported to earn roughly 44% of DEX fee revenue on that network.”
reviewerTVL had recovered to about $2 billion by 2025, mostly on Ethereum, and Curve earns roughly 44% of DEX fee revenue on that networkThe $2B TVL figure and 44% fee share are both real but rest on a single annual-report source and a specific month (December 2025) rather than being representative of '2025' broadly; some DefiLlama dashboard snapshots in the same period show materially lower TVL (~$1.26-1.3B), so the figure should be treated as a point-in-time high-water mark rather than a settled 2025 average.
confirmed
26 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Background
“Curve Finance was founded by Michael Egorov, a Russian physicist and entrepreneur who previously co-founded NuCypher, a privacy-focused infrastructure company.”
reviewerMichael Egorov founded Curve and previously co-founded NuCypherMultiple independent profiles corroborate Egorov's NuCypher role and physics background; 'privacy-focused infrastructure' is a reasonable characterization of NuCypher's encryption/data-protection focus. - #2[confirmed][no action needed]in section: Background
“The protocol launched on Ethereum in January 2020 as a decentralized exchange liquidity pool designed for low-slippage, low-fee trading of stablecoins and similarly pegged assets.”
reviewerCurve launched on Ethereum in January 2020January 2020 is the consensus date across sources; one low-quality wiki (IQ.wiki) gives June 2020 but is an outlier and not used by the page. - #3[confirmed][no action needed]in the timeline
“Michael Egorov publishes the StableSwap whitepaper, setting out the AMM formula that became Curve Finance.”
reviewerEgorov published the StableSwap whitepaper in November 2019Confirmed by Curve's own documentation. - #4[confirmed][no action needed]in the timeline
“CRV governance token and Curve DAO contracts deployed on August 13 by the anonymous community member 0xc4ad.”
reviewerCRV token and Curve DAO contracts were deployed August 13, 2020 by an anonymous community member using the handle 0xc4ad, not by the Curve teamWell corroborated by multiple outlets describing this as one of DeFi's stranger token launches. - #5[confirmed][no action needed]in section: Background
“In 2021 Curve launched Cryptoswap (Curve v2), extending its AMM design to volatile asset pairs, and expanded to Layer 2 networks and other Layer 1 chains including Polygon, Arbitrum, Avalanche and Fantom.”
reviewerCurve v2 (Cryptoswap) launched in 2021, extending the AMM to volatile asset pairsConsistent with general industry reporting; not independently re-verified chain-by-chain but uncontroversial. - #6[confirmed][no action needed]in section: Background
“By mid-2023 Curve was among the largest DeFi protocols by total value locked (TVL), with about $3.26 billion shortly before the July 2023 exploit.”
reviewerCurve's TVL was about $3.26 billion shortly before the July 2023 exploitCorroborated across multiple analyses citing DefiLlama data. - #7[confirmed][no action needed]in section: Vyper compiler vulnerability: technical root cause
“Vyper versions 0.2.15, 0.2.16 and 0.3.0 contained a broken implementation of reentrancy locks: the compiler allocated a separate storage slot for each @nonreentrant decorator it encountered, even when several decorators shared the same lock key.”
reviewerVyper versions 0.2.15, 0.2.16 and 0.3.0 contained the broken reentrancy-lock implementation exploited in July 2023Directly confirmed against the primary post-mortem. - #8[confirmed][no action needed]in section: Vyper compiler vulnerability: technical root cause
“The root cause traces to changes made in v0.2.13 to address an unrelated storage-slot collision; a later fix in v0.2.15 removed a guard that checked whether a nonreentrant key had already been given a storage slot, introducing the vulnerability.”
reviewerThe bug traces to v0.2.13 changes; a v0.2.15 fix removed a guard against duplicate nonreentrant-key slot allocation, introducing the vulnerability; v0.3.1 restored key-based deduplicationMinor nuance: the specific storage collision was first reported against v0.2.14 (itself yanked), but the post-mortem's own root-cause summary cites v0.2.13, matching the page. - #9[confirmed][no action needed]in section: July 2023 exploit: attack sequence and losses
“JPEG'd's pETH/ETH pool (compiled with Vyper 0.2.15) lost about $11-12 million. Alchemix's alETH/ETH pool lost about $20 million ($17 million in ETH and $3 million in ERC-20 tokens). Metronome DAO's msETH/ETH pool lost about $1.6 million.”
reviewerAttack began about 9:30 AM ET on July 30, 2023, hitting at least four pools with specified losses: JPEG'd ~$11-12M, Alchemix ~$20M ($17M ETH + $3M ERC-20), Metronome ~$1.6M, Curve CRV/ETH ~$18-22MDirectly verified against the cited Chainalysis source. - #11[confirmed][no action needed]in section: Market impact of the exploit
“Accounts of the TVL decline differ slightly: one puts it at 47%, from $3.26 billion to about $1.73 billion within a day; CryptoSlate puts it at about 46%, from about $3.26 billion to $1.72 billion within 24 hours.”
reviewerCurve's TVL fell about 46-47% within 24 hours, from roughly $3.26B to about $1.72-1.73BConfirmed, within the range of other outlets' TVL-drop figures found in independent search (ForkLog $3.25B->$1.73B, FXStreet $3.27B->$1.68B). - #13[confirmed][no action needed]in section: Fund recovery and bounties
“The pseudonymous operator c0ffeebabe.eth used MEV bots to front-run the attackers, recovering about $5.3 million from the CRV/ETH pool and about $1.6 million from the Metronome msETH pool, and returned both sums to the affected protocols.”
reviewerc0ffeebabe.eth recovered and returned about $5.3 million from the CRV/ETH pool and about $1.6 million from the Metronome poolDirectly confirmed against the cited Chainalysis source. - #14[confirmed][no action needed]in section: Fund recovery and bounties
“The attacker of Alchemix's alETH pool voluntarily returned about $12.7 million (4,820 alETH and 2,258 ETH) by August 8, 2023, and later returned further amounts, so that Alchemix was made fully whole. JPEG'd recovered about $10 million.”
reviewerThe alleged Alchemix attacker voluntarily returned about $12.7 million (4,820 alETH and 2,258 ETH) by August 8, 2023, and JPEG'd recovered about $10 millionDirectly confirmed. - #15[confirmed][no action needed]in section: Fund recovery and bounties
“After that deadline passed without full compliance, Curve opened a public bounty of $1.85 million for information leading to the identification and conviction of any remaining exploiter.”
reviewerCurve opened a $1.85 million public bounty on August 6, 2023 after the 10% return deadline passedDirectly verified by fetching the cited article; it is live despite being flagged unarchivable in the page's own archive metadata. - #16[confirmed][no action needed]in section: Fund recovery and bounties
“By August 7, 2023, about 73% of the stolen funds (about $52.3 million) had been recovered or returned.”
reviewerBy August 7, 2023, about 73% of stolen funds (about $52.3 million) had been recovered or returnedConfirmed by headline source. - #17[confirmed][no action needed]in section: Victim compensation and pool remediation
“On December 21, 2023, 94% of participating CRV holders approved a governance proposal to disburse about $49.2 million to liquidity providers hurt by the July 2023 hack, covering losses in the Curve CRV pool, Alchemix's alETH pool, JPEG'd's pETH pool and Metronome's msETH pool.”
reviewerOn December 21, 2023, 94% of participating CRV holders approved disbursing about $49.2 million to LPs hurt by the July 2023 hackConfirmed via the live CoinGape article; the originally-cited Cointelegraph article on this claim is dead (see separate link_rot finding). - #18[confirmed][no action needed]in section: Founder's CRV-backed loans and the 2023 liquidation risk
“At the time of the exploit, founder Michael Egorov had borrowed about $100 million across several DeFi lending protocols, including Aave, Fraxlend, Abracadabra and Inverse Finance, collateralized almost entirely by CRV. He had pledged about 427.5 million CRV, nearly 47% of the circulating supply.”
reviewerAt the time of the exploit, Egorov had borrowed about $100 million across DeFi lending protocols, pledging about 427.5 million CRV (nearly 47% of circulating supply)Confirmed with reasonably close cross-source agreement given this was a fast-changing, multi-day situation. - #19[confirmed][no action needed]in section: Founder's CRV-backed loans and the 2023 liquidation risk
“His largest position was an approximately $63 million USDT loan on Aave V2, backed by about 34% of the total CRV supply, with a liquidation threshold of $0.3767 per CRV.”
reviewerEgorov's largest position was a ~$63 million USDT loan on Aave V2, backed by ~34% of CRV supply, with a liquidation threshold of $0.3767Directly verified against the cited CoinDesk article. - #22[confirmed][no action needed]in section: Founder's CRV-backed loans and the 2023 liquidation risk
“By late September 2023 Egorov had deposited $35 million in CRV to close his Aave position entirely, and the cascade was avoided.”
reviewerBy late September 2023 Egorov had deposited $35 million in CRV to close his Aave position entirelyConsistent with independent reporting of Egorov fully settling the Aave position. - #23[confirmed][no action needed]in the timeline
“The informal six-month OTC lockup expires. Several OTC buyers sell CRV on exchanges, pushing the price below $0.40.”
reviewerWhen the informal six-month lockup expired in February 2024, several OTC buyers moved CRV to exchanges and sold, pushing CRV below $0.40Confirmed by headline/framing of the cited Protos article. - #24[confirmed][no action needed]in section: Founder liquidations and bad debt (2024)
“His whole position, $95.7 million in stablecoin loans (mainly crvUSD) collateralized by about $141 million in CRV, was liquidated across five protocols: Inverse Finance, UwU Lend, Fraxlend, Curve's own LlamaLend and Aave.”
reviewerIn June 2024 Egorov's $95.7 million in stablecoin loans, collateralized by about $141 million in CRV, was liquidated across five protocols (Inverse Finance, UwU Lend, Fraxlend, LlamaLend, Aave)Confirmed. - #26[confirmed][no action needed]in section: Founder liquidations and bad debt (2024)
“Egorov then sold 30 million CRV to Christian Seale of NextGen Venture Partners for $6 million USDT to clear the bad debt, which he said was fully repaid.”
reviewerEgorov sold 30 million CRV to Christian Seale of NextGen Venture Partners for $6 million USDT to clear the bad debtConfirmed via secondary corroboration of the cited article's content. - #28[confirmed][no action needed]in section: May 2025 X account compromise and DNS hijack
“Smart contracts were not affected in either incident, and the protocol processed over $400 million in on-chain volume while the frontend was unreachable.”
reviewerIn May 2025 Curve's X account was compromised (May 5) and the curve.fi domain was hijacked at the registrar level (May 12), with contracts unaffected and over $400 million in on-chain volume processed during the outageDirectly confirmed against Curve's own post-incident page. - #29[confirmed][no action needed]in section: May 2025 X account compromise and DNS hijack
“After the registrar attack, Curve moved its primary domain to curve.finance.”
reviewerAfter the registrar attack, Curve moved its primary domain to curve.financeCurve's own incident page frames curve.finance as the access point 'for the time being,' but later governance/aggregator sources confirm it became the permanent official domain, so the page's framing holds up as of current information. - #30[confirmed][no action needed]in section: Security posture, audits and current status
“In August 2025 Curve cut annual CRV inflation to 5.02%, removing about 22 million tokens a year of emissions pressure.”
reviewerIn August 2025 Curve cut annual CRV inflation to 5.02%, removing about 22 million tokens a year of emissionsConfirmed against Curve's own emissions announcement. - #32[confirmed][no action needed]in section: Security posture, audits and current status
“Curve has been audited by ChainSecurity, Quantstamp, StateMind and MixBytes, with ChainSecurity audits continuing through at least December 2024.”
reviewerCurve has been audited by ChainSecurity, Quantstamp, StateMind and MixBytes, with ChainSecurity audits continuing through at least December 2024Confirmed and, if anything, conservative -- ChainSecurity engagements continued beyond December 2024 per Curve's own audit log. - #33[confirmed][no action needed]in section: Victim compensation and pool remediation
“The two pages describe this structure in different units: about 5,919 ETH plus 34.7 million newly minted CRV according to one, and about $7.2 million in ETH plus about $42 million in CRV according to the other.”
reviewerCompensation payout breakdown: about 5,919 ETH plus 34.7 million newly minted CRV, or alternatively about $7.2 million in ETH plus about $42 million in CRVBoth breakdowns appear in independent reporting; the page's practice of presenting them as two unit-systems for the same total is reasonable and not misleading.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.