Curve Finance‘s DeFi project, which was targeted by an attacker who stole millions of dollars worth of funds, has not fully recovered all the stolen funds, although the attacker has returned some of the funds. The DeFi protocol has put up a reward for identifying the attacker and publicly sharing their identity, as well as returning all the stolen funds.
$1.85 Million Reward Offered
Curve Finance has offered a $1.85 million reward to anyone who can correctly identify the attacker and ensure their legal conviction. The DeFi protocol included a message in the input data of an Ethereum transaction stating, “The deadline for the Curve Finance attacker to voluntarily return the funds has passed. We are now making the reward public and will give 10% of the stolen funds (currently $1.85 million) as a reward to the person who can identify my identity in a way that leads to the legal conviction of the attacker.”
Curve Finance also stated that if the attacker returns all the stolen funds, the matter will not be pursued further, and the entire message was shared through their official X (formerly Twitter) account.
Curve Finance Attacker: I’m Smarter Than All of You
After an attacker used vulnerable versions of the Vyper programming language to carry out re-centralization attacks on targeted stablecoin pools, over $61 million was withdrawn from Curve Finance’s pools on July 30th.
Although the attacker offered a reward for 10% of the stolen funds and returned them to the Alchemix and JPEGd projects, no funds were returned to the other pools from which they were withdrawn.
In a message attached to a specific transfer transaction, the attacker stated, “I want to clarify that I am returning the funds not because you can find me, but because I don’t want to ruin your project. It may be a lot of money for many people, but not for me. I’m smarter than all of you.”
