Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Curve Finance Affected by Vyper Vulnerability: $25.12M Reported Loss

·Historical incident record

Incident Overview

Curve Finance tweeted that many stablecoin pools (alETH/msETH/pETH) using Vyper 0.2.15 were attacked due to a faulty recursive lock. crvUSD contracts and other fund pools are not affected. As of now, the Curve Finance stablecoin pool hack has caused a cumulative loss of $73.5 million to Alchemix, JPEG'd, MetronomeDAO, deBridge, Ellipsis, and CRV/ETH pools. On August 6, Alchemix tweeted that the Curve Finance hacker had returned all of Alchemix's funds in the Curve pool. On August 19, MetronomeDAO stated that a MEV bot named "c0ffeebabe" had recovered most of the stolen funds and returned them to Metronome.

Sources & References

Original incident referencehttps://www.panewslab.com/zh/sqarticledetails/wu339f1f.html (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodMalicious Code Injection Attack
    Reported loss$ 428,000
  2. Incident date
    Attack methodGovernance Attack
    Reported loss$ 30,000,000
  3. Incident date
    Attack methodAccount Compromise
    Reported lossNot disclosed
  4. Incident date
    Target

    Alchemix

    Attack methodAffected by Vyper Vulnerability
    Reported loss$ 35,315,843
  5. Incident date
    Target

    JPEG'd

    Attack methodReentrancy Attack
    Reported loss$ 11,363,266