Curve Finance Offers $1.85 Million Public Bounty to Find Hacker

In an on-chain message, the Curve Finance hacker noted that they are returning the funds to Alchemix since they don't want to ruin the project.
By Bhushan Akolkar
— Curve Finance (@CurveFinance)

A week ago, the decentralized finance (DeFi) platform Curve Finance faced a major exploit with hackers stealing north of $60 million in funds. After a week of failing to meet the deadline to return the funds, Curve Finance has decided to drag the exploiter to court and pursue the case further.

Curve and other protocols impacted by the attack tried to stop the hacker and offered them a reward of 10% of the stolen funds, totaling more than $6 million. The hacker accepted the offer and returned some of the stolen assets to Alchemix and JPEGd.

However, it didn’t complete refunds to other affected pools. Now, since the deadline has passed, Curve Finance is offering a public bounty. Thus, anyone identifying the attacker shall receive rewards with assets worth $1.85 million. In an on-chain message, Curve Finance noted:

“The deadline for the voluntary return of funds in the Curve exploit passed at 0800 UTC. We now extend the bounty to the public, and offer a reward valued at 10% of remaining exploited funds (currently $1.85M USD) to the person who is able to identify the exploited in a way that leads to a conviction in the courts,” adding that “if the exploiter chooses to return the funds in full, we will not pursue this further.”

Curve Finance Stablecoin Restores

After a strong fall last week, it seems that Curve Finance’s native stablecoin crvUSD has restored its dollar peg.

Before returning the stolen funds, the attacker sent a message to the Alchemix and Curve teams, saying that they were doing it not because they were afraid of being caught, but because they didn’t want to harm their projects. “I’m refunding not because you can find me, it’s because I don’t want to ruin your project,” as per the on-chain message by the attacker.

The attack took place on July 30 and resulted in more than $61 million being stolen from Curve’s pools, including large amounts from Alchemix’s, JPEGd’s, and Metronome’s pools. The attacker used a technique called reentrancy attacks on vulnerable versions of the Vyper programming language to target stable pools.

Advertisement
Bhushan Akolkar
Bhushan is a seasoned crypto writer with over eight years of experience spanning more than 10,000 contributions across multiple platforms like CoinGape, CoinSpeaker, Bitcoinist, Crypto News Flash, and others. Being a Fintech enthusiast, he loves reporting across Crypto, Blockchain, DeFi, Global Macros with a keen understanding in financial markets. 

He is committed to continuous learning and stays motivated by sharing the knowledge he acquires. In his free time, Bhushan enjoys reading thriller fiction novels and occasionally explores his culinary skills. Bhushan has a bachelors degree in electronics engineering, however, his interest in finance and economics drives him to crypto and blockchain.
Why trust CoinGape: CoinGape has covered the cryptocurrency industry since 2017, aiming to provide informative insights to our readers. Our journalists and analysts bring years of experience in market analysis and blockchain technology to ensure factual accuracy and balanced reporting. By following our Editorial Policy, our writers verify every source, fact-check each story, rely on reputable sources, and attribute quotes and media correctly. We also follow a rigorous Review Methodology when evaluating exchanges and tools. From emerging blockchain projects and coin launches to industry events and technical developments, we cover all facets of the digital asset space with unwavering commitment to timely, relevant information.
Investment disclaimer: The content reflects the author’s personal views and current market conditions. Please conduct your own research before investing in cryptocurrencies, as neither the author nor the publication is responsible for any financial losses.
Ad Disclosure: This site may feature sponsored content and affiliate links. All advertisements are clearly labeled, and ad partners have no influence over our editorial content.