Curve Finance exploited in ongoing attack
Important takeaways
- Curve Finance suffers from ongoing exploitation.
- A malicious contract has so far raked in more than $573,000 from victims.
- The Curve team has warned users not to interact with the frontend until further notice.
Share this article
The DeFi protocol Curve is currently being leveraged through the front end. Over $573,000 has already been taken by the attacker.
Frontend exploited
Curve Finance is being exploited.
According to Paradigm researcher samczsun, Curve’s frontend is currently compromised. The researcher warned Curve users not to use the protocol until further notice.
Curve later appeared confirm the ongoing exploit on Twitter, writing in response to samczsun: “Don’t use frontend yet. Investigating!”
On-chain data performance that the malicious contract associated with the exploit appears to have collected over $573,000 in USDC and DAI from eight different victims so far. The funds, already transfered to the attacker’s wallet and exchanged for ETH tokens, were sent to the FixedFloat crypto exchange, first in groups of 45 ETH, then in amounts from 20 to 22 ETH.
At press time, the attacker had also started sending tokens through cryptocurrency mixer Tornado Cash, which was sanctioned by the US Treasury Department yesterday.
The Curve team suggested that the attacker possibly cloned the Curve website, did Domain Name System (DNS) directly against the fraudulent website, and then added authentication requests to the malicious contract. It further clarified that curve.exchange, unlike curve.fi, appears to have been unaffected.
Curve Finance is a decentralized finance (DeFi) protocol that provides “extremely efficient” stablecoin trading services with low slippage and fees. It is considered a pillar of the DeFi ecosystem, with over $6 billion in total value locked up.
Update: The Curve team posted on Twitter at 08:27 UTC that the exploit had been patched, and urged Curve users to revoke Curve contracts they may have approved in the past few hours.
Update 2: FixedFloat announced that funds of 112 ETH have been frozen in connection with the exploitation.
This is a developing story.
Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.
