Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2fi7UU…Xo2GSummary
Curve Finance is a decentralized exchange and automated market maker (AMM) on Ethereum, operating since January 2020 and optimized for low-slippage swaps of stablecoins and other pegged assets. On July 30, 2023, a latent reentrancy flaw in the Vyper compiler (versions 0.2.15, 0.2.16 and 0.3.0) was exploited across several Curve pools, draining roughly $70 million; about 73% was later recovered or returned, and in December 2023 the Curve DAO voted to disburse about $49.2 million to affected liquidity providers. Separately, founder Michael Egorov's practice of borrowing large sums against CRV tokens created systemic risk for DeFi lending markets, ending in a roughly $140 million liquidation in June 2024 that left more than $10 million in bad debt, and a further liquidation in December 2024.
Connected Entities
11 entities · 60 linked investigations- Wintermute→mentioned with→Ethereum(70%)
- Justin Sun→mentioned with→Ethereum(65%)
- Fantom (Sonic Labs)→mentioned with→Wintermute(60%)
- Curve DEX→mentioned with→Arbitrum(60%)
- Curve Finance→mentioned with→Ethereum(80%)
- Curve DEX→mentioned with→Wintermute(60%)
- Curve Finance→mentioned with→Aave(70%)
- Curve DEX→mentioned with→Ethereum(80%)
- Curve DEX→mentioned with→Polygon(60%)
- Curve DEX→mentioned with→Fantom (Sonic Labs)(60%)
- + 19 more
Timeline(24 events)
November 2019
Michael Egorov publishes the StableSwap whitepaper, setting out the AMM formula that became Curve Finance.
Coin BureauJanuary 2020
Curve Finance launches on Ethereum mainnet as a stablecoin-optimized DEX.
Gemini CryptopediaAugust 2020
CRV governance token and Curve DAO contracts deployed on August 13 by the anonymous community member 0xc4ad.
Gemini CryptopediaJuly 2021
Vyper v0.2.15 is released, unintentionally introducing the reentrancy-lock storage-slot bug, which went undetected for two years.
Vyper team post-mortemNovember 2021
Vyper v0.2.16 and v0.3.0 are released, still carrying the reentrancy vulnerability.
Vyper team post-mortem2022
Vyper v0.3.1 fixes the reentrancy lock defect, but pools already deployed with earlier versions remain vulnerable.
CertiKJuly 2023
On July 30, attackers exploit Curve pools compiled with vulnerable Vyper versions: JPEG'd pETH/ETH (~$11-12M), Alchemix alETH/ETH (~$20M), Metronome msETH/ETH (~$1.6M) and Curve CRV/ETH (~$18-22M). Total losses are estimated at about $69-73 million.
ChainalysisJuly 2023
On July 31, CRV falls more than 20% and Curve TVL drops from about $3.26B to about $1.72-1.73B. Egorov's $100M+ in CRV-backed loans are at risk of cascading liquidation, and Gauntlet recommends that Aave DAO freeze CRV markets.
CoinDeskAugust 2023
Curve offers exploiters a 10% bounty if funds are returned by August 4. c0ffeebabe.eth returns about $5.3M from the CRV/ETH pool and about $1.6M from the Metronome pool.
CointelegraphAugust 2023
Michael Egorov sells about 106 million CRV over the counter at $0.40 per token (about $42-42.4 million) to 53 investors to reduce his loan exposure.
The BlockAugust 2023
The August 4 bounty deadline passes without every exploiter returning funds. The Alchemix attacker begins returning funds voluntarily.
CoinDeskAugust 2023
On August 6, Curve opens a $1.85 million public bounty for information leading to the identification and conviction of the remaining exploiters.
The BlockAugust 2023
By August 7, about 73% of stolen funds (about $52.3 million) have been recovered or returned, and the Curve DAO receives ETH recovered by white hats.
CoinDeskAugust 2023
By August 8, the alleged Alchemix attacker has voluntarily returned about $12.7 million (4,820 alETH and 2,258 ETH).
ChainalysisDecember 2023
On December 21, the Curve DAO votes 94% in favor of disbursing about $49.2 million in compensation to LPs in the CRV, alETH, pETH and msETH pools.
CointelegraphFebruary 2024
The informal six-month OTC lockup expires. Several OTC buyers sell CRV on exchanges, pushing the price below $0.40.
ProtosJune 2024
CRV falls about 24-30% over June 12-13. Egorov's entire CRV collateral position (about $141 million) is liquidated across Inverse, UwU Lend, Fraxlend, LlamaLend and Aave, leaving more than $10 million in bad debt on Curve Lend.
DecryptJune 2024
Egorov sells 30 million CRV for $6 million USDT to clear the LlamaLend bad debt and says it has been fully repaid.
CointelegraphDecember 2024
A CRV slump triggers a further liquidation of Egorov's positions, according to CoinDesk.
CoinDeskMay 2025
On May 5, Curve's official X account is compromised and used to promote a fraudulent CRV airdrop phishing campaign.
Vibranium AuditsMay 2025
On May 12, the curve.fi domain is hijacked at the DNS registrar and visitors are redirected to a phishing site. Smart contracts are unaffected, and more than $400 million in on-chain volume is processed during the outage.
Curve NewsAugust 2025
Curve cuts annual CRV inflation to 5.02%, removing about 22 million tokens a year of emissions.
LlamaRiskDecision Log
- slot 457866756 · hash 7UcTNKtUSMPi2UdGcf4ktCoGpjwqskBKegR1rJywMFZ5
- slot 457849570 · hash 7Rq7prYzmxgGTd8eUgbfmL6N6JzpaHSvAQwKRcmxeYAc
- slot 426514236 · hash 8iyKXWPVhazzSQaysxFCg29LivSAY7E26WZtPXN8oCFg
- slot 426514232 · hash 9rKPLqj84RRiKPEKkHjJaoR8PSbqNizsPoaNMk63WgMs
- slot 426283257 · hash 6c3oobhKZAsXyVXaDkcFfHE4FrNDzSFWg7j8bPWBe4mX
- slot 426283255 · hash BomjZszyVSvz3UtTFgGEiYpBXhPFhTEDqZC8rXkrk9Aq
- hash A1vdmoFxQrEfSmRGXMBSHtEgmWvus7r8xnVSgpJq3qFF
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 37 of 42 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 5/4/2026, 2:54:48 AM
last updated: 10/2/2026, 5:27:46 AM
5 viewsavoid.net — verified advice for a post-truth world