Curve Finance Breach Puts $100 Million Worth of Crypto at Risk

Written by: By Sam Kessler, Danny Nelson Compiled by: Kate, Marsbit

Curve, the stablecoin trading platform at the heart of decentralized finance (DeFi) on Ethereum, has fallen victim to a bug, according to a tweet from the project.

! [Curve] (https://img-cdn.gateio.im/resized-social/moments-40baef27dd-45f1d77e36-dd1a6f-7649e1)

More than $100 million worth of cryptocurrency is at risk due to a "reentrancy" vulnerability in Vyper, a programming language used to power parts of the Curve system. So far, several stablecoin pools on the platform (used for pricing and liquidity for many different DeFi services) have been drained by hackers.

The same vulnerability may exist in other projects using the Vyper programming language.

At press time, it was unclear how much money Curve lost as a result of the attack. In a preliminary analysis posted on Twitter by blockchain auditing firm BlockSec, the total loss was estimated at more than $42 million.

According to Curve’s website, the company operates 232 different mining pools, but only those using Vyper versions 0.2.15, 0.2.16, and 0.3.0 are at risk, Curve team member Mimaklas said in a Discord announcement.

Mimaklas also stated that "all affected pools have been drained and the team is assessing the situation with the affected teams."

! [Curve] (https://img-cdn.gateio.im/resized-social/moments-40baef27dd-4e43c074ca-dd1a6f-7649e1)

The theft has destabilized trading markets for Curve DAO’s native CRV token, which is down 17% on the day at $0.61 at press time. Such price swings could add to the chaos by forcing the Curve founder's $70 million borrowing position with Aave to be liquidated.