Curve Finance
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3bUs7a…4jt8Summary
Curve Finance is a major decentralized exchange (DEX) on Ethereum optimized for stablecoin and pegged-asset trading, operating since January 2020. On July 30, 2023, a latent vulnerability in the Vyper smart-contract compiler (versions 0.2.15, 0.2.16, and 0.3.0) was exploited across multiple Curve liquidity pools, draining approximately $70 million and triggering a near-systemic crisis when the resulting CRV price drop threatened to cascade-liquidate founder Michael Egorov's heavily collateralized on-chain loans. Roughly 73% of stolen funds were ultimately recovered or returned, and in December 2023 the Curve DAO voted to disburse approximately $49 million in compensation to affected liquidity providers.
Connected Entities
1 entities- + 1 more
Timeline(12 events)
2020
Curve Finance launches on Ethereum mainnet as a stablecoin-optimized DEX.
July 2021
Vyper v0.2.15 released, inadvertently introducing the reentrancy lock storage-slot bug that would remain undetected for two years.
November 2021
Vyper v0.2.16 and v0.3.0 released, perpetuating the reentrancy vulnerability.
2022
Vyper v0.3.1 released, fixing the reentrancy lock defect — but pools already deployed with earlier versions remain vulnerable.
30 July 2023
July 30, 2023: Attackers begin exploiting Curve Finance pools compiled with vulnerable Vyper versions. JPEG'd pETH/ETH (~$11M), Alchemix alETH/ETH (~$20M), Metronome msETH/ETH (~$1.6M), and Curve CRV/ETH (~$18-22M) pools are drained. Total losses approximately $69-73 million.
31 July 2023
CRV token price falls over 20%. Curve TVL drops from ~$3.26B to ~$1.72B. Egorov's $100M+ in on-chain loans put at risk of liquidation cascade. Gauntlet recommends Aave DAO freeze CRV markets.
August 2023
Curve Finance offers 10% bounty to exploiters if funds are returned by August 4. c0ffeebabe.eth returns ~$5.3M from CRV/ETH pool and ~$1.6M from Metronome pool.
August 2023
Michael Egorov conducts approximately $42.4 million in OTC CRV token sales at $0.40/token to reduce loan exposure and avoid cascade liquidation.
4 August 2023
Bounty deadline passes without full fund return from all exploiters. Alchemix attacker begins returning funds voluntarily.
6 August 2023
Curve Finance opens $1.85 million public bounty for information leading to identification and conviction of remaining exploiters.
7 August 2023
Approximately 73% of stolen funds recovered or returned. Curve DAO receives recovered ETH from white hat operations.
21 December 2023
Curve DAO votes 94% in favor to disburse approximately $49.2 million in compensation to affected liquidity providers across CRV, alETH, pETH, and msETH pools.
Decision Log
- hash: 6V56N4j3wz3wP9NZCjq9JjWLS5k1XPj16JXLKHCnKX7A
- hash: 86iX57YrE4RGDhzNf5iLnancVeTWtBxfmnh7QWTJsXTB
- hash: 78WxV5TehKZBJPyZaKcuM4g5Z5o1e95FSdUXCbgDz8nP
- hash: CxpHK4FrhoY5E5DjL6V7UXSWKxdXqCoDHLbwKKw8XxFg
- hash: 8RiJLNXtgAzMN5jm6fYGxDZsn4LfGVeVXEqudtZaLv12
This investigation is cryptographically anchored to the Solana blockchain (5 events). 0 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:32:22 PM
last updated: 8/29/2026, 1:35:20 AM
avoid.net — verified advice for a post-truth world