Public Bounty: $1.8 Million Reward Offered for Finding Remaining Funds in Curve Finance Hack

Public Bounty: $1.8 Million Reward Offered for Finding Remaining Funds in Curve Finance Hack

Curve Finance has managed to recover approximately 73% of the funds stolen during a recent hack, which resulted in a staggering loss of over $73 million worth of various tokens, triggering a ripple effect across the broader ecosystem.

In a remarkable turn of events, the stolen funds from the lending protocol AlchemixFi have been fully returned over the past week, amounting to a sum of $22 million in ether (ETH) and ether derivatives. Notably, a trading bot successfully returned 90% of the stolen ether from JPEGd, while an ethical hacker under the alias “c0ffeebabe.eth” contributed by returning over $6 million worth of assets from the synthetic protocol Metronome. Another ethical hacker also stepped up and restored $13 million worth of assets from Alchemix.

The hack primarily targeted Curve Finance, a platform that enables users to efficiently exchange stablecoins. The attackers employed a reentrancy attack technique, exploiting vulnerabilities in the system to siphon tokens from Curve, Metronome, and Alchemix. As a response, these affected protocols offered a 10% bounty for the safe return of the stolen assets by August 6, as previously reported.

Reentrancy, a common bug, facilitated the attackers’ ability to deceive smart contracts by repeatedly issuing software commands to the protocol, ultimately leading to asset theft. The root cause of the attack was traced back to faulty code written in Vyper, a programming language used to power specific components of the Curve system.

Following the incidents, Curve Finance extended a 10% bounty offer to the attackers, encouraging them to return the stolen funds. On Friday, the attacker initiated the process of returning funds to Alchemix after confirming the deposit address through a message on the blockchain.

Despite significant efforts to recover the assets, a substantial amount of over $18 million in stolen funds remains unaccounted for. Consequently, Curve Finance has decided to open up the bounty to the public on Sunday night, inviting the community to participate in identifying the exploiter.

In a blockchain transaction, Curve Finance stated, “The deadline for the voluntary return of funds in the Curve exploit has passed at 0800 UTC. We now extend the bounty to the public and offer a reward valued at 10% of the remaining exploited funds (currently $1.85M) to the individual who can identify the exploiter in a manner that leads to a conviction in the courts. If the exploiter chooses to return the funds in full, we will not pursue this further,” the protocol added.

The return of the recovered funds has significantly uplifted confidence in Curve Finance, widely acknowledged as one of the most influential platforms in the DeFi ecosystem. Consequently, its governance tokens CRV experienced a notable price decline of nearly 30%, plummeting from 72 cents to a low of 50 cents in the aftermath of the exploit. However, with the recent positive developments and recovered funds, CRV has since rebounded, currently trading at 61 cents as of Monday morning.