Decentralized finance platform Curve Finance has officially announced its intention to refund users affected by the recent attack that resulted in a loss of $62 million. The hacker behind the attack took advantage of a security vulnerability in the Curve Finance software update and started refunding the stolen funds after it was announced that 10% of the stolen funds would be rewarded.
Exploiting a Security Vulnerability
According to a Twitter post from the platform’s official account, ongoing investigations are making progress, and approximately 79% of the funds have been successfully recovered. The platform also announced that it will evaluate each affected user for refunds.
This evaluation aims to ensure the fair distribution of resources. The incident on July 30th was carried out by a malicious hacker who took advantage of security vulnerabilities in Curve Finance’s Vyper compiler.
The person behind the attack targeted versions 0.2.15 to 0.3.0 of the Vyper compiler. Detecting these security vulnerabilities requires a significant amount of skill and resources, as emphasized by experts in the field.
A developer who contributed to Viper stated that the attack was likely planned weeks before it was executed. The targeted pools affected by the attack included CRV/ETH, alETH/ETH, msETH/ETH, and pETH/ETH, as well as three pools on the Layer-2 scaling network Arbitrum, raising concerns about their potential impact.
$8 Million Refunded
According to experts in the field, the attack spread throughout the entire DeFi ecosystem. A comprehensive review of the breach highlighted an issue in the emerging cryptocurrency sector. The lack of adequate incentives to identify security vulnerabilities in previous software updates continues to make such attacks a target.
10% of the stolen assets were offered as a reward to the responsible person behind the attack, and upon accepting this offer, the hacker started refunding the funds. According to on-chain data from Etherscan, the total value of the refunded funds reached 4,821 Ethereum at the time of writing this article, equivalent to approximately $8,891,578.
I love that