Curve Finance
Summary
Curve Finance is a major decentralized exchange (DEX) on Ethereum optimized for stablecoin and pegged-asset trading, operating since January 2020. On July 30, 2023, a latent vulnerability in the Vyper smart-contract compiler (versions 0.2.15, 0.2.16, and 0.3.0) was exploited across multiple Curve liquidity pools, draining approximately $70 million and triggering a near-systemic crisis when the resulting CRV price drop threatened to cascade-liquidate founder Michael Egorov's heavily collateralized on-chain loans. Roughly 73% of stolen funds were ultimately recovered or returned, and in December 2023 the Curve DAO voted to disburse approximately $49 million in compensation to affected liquidity providers.
Connected Entities
1 entities- + 1 more
Timeline(12 events)
2020-01-01
Curve Finance launches on Ethereum mainnet as a stablecoin-optimized DEX.
2021-07-01
Vyper v0.2.15 released, inadvertently introducing the reentrancy lock storage-slot bug that would remain undetected for two years.
2021-11-01
Vyper v0.2.16 and v0.3.0 released, perpetuating the reentrancy vulnerability.
2022-01-01
Vyper v0.3.1 released, fixing the reentrancy lock defect — but pools already deployed with earlier versions remain vulnerable.
2023-07-30
July 30, 2023: Attackers begin exploiting Curve Finance pools compiled with vulnerable Vyper versions. JPEG'd pETH/ETH (~$11M), Alchemix alETH/ETH (~$20M), Metronome msETH/ETH (~$1.6M), and Curve CRV/ETH (~$18-22M) pools are drained. Total losses approximately $69-73 million.
2023-07-31
CRV token price falls over 20%. Curve TVL drops from ~$3.26B to ~$1.72B. Egorov's $100M+ in on-chain loans put at risk of liquidation cascade. Gauntlet recommends Aave DAO freeze CRV markets.
2023-08-01
Curve Finance offers 10% bounty to exploiters if funds are returned by August 4. c0ffeebabe.eth returns ~$5.3M from CRV/ETH pool and ~$1.6M from Metronome pool.
2023-08-01
Michael Egorov conducts approximately $42.4 million in OTC CRV token sales at $0.40/token to reduce loan exposure and avoid cascade liquidation.
2023-08-04
Bounty deadline passes without full fund return from all exploiters. Alchemix attacker begins returning funds voluntarily.
2023-08-06
Curve Finance opens $1.85 million public bounty for information leading to identification and conviction of remaining exploiters.
2023-08-07
Approximately 73% of stolen funds recovered or returned. Curve DAO receives recovered ETH from white hat operations.
2023-12-21
Curve DAO votes 94% in favor to disburse approximately $49.2 million in compensation to affected liquidity providers across CRV, alETH, pETH, and msETH pools.
Decision Log
- hash: 8RiJLNXtgAzMN5jm6fYGxDZsn4LfGVeVXEqudtZaLv12
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:32:22 PM
last updated: 5/30/2026, 6:32:25 PM
avoid.net — verified advice for a post-truth world