Looter Behind $61M Curve Hack Starts Returning Assets, Raising Hope for Recovery

The exploited protocols offered a 10% bounty Thursday for returning the rest of the assets until the end of this week.

AccessTimeIconAug 4, 2023 at 2:31 p.m. UTC
Updated Aug 7, 2023 at 3:13 p.m. UTC

The exploiter responsible for draining $61 million assets held on decentralized exchange Curve Finance has returned some of the stolen crypto after engaging in talks with one of the victims on Friday, blockchain data shows.

In a message linked to an Ethereum blockchain transaction, the looter asked Alchemix, one of the victims of the heist, to confirm the protocol's address where he could return the assets. Soon after, he transferred almost $10 million of ether (ETH) and alETH to Alchemix's multisignature wallet in multiple transactions, blockchain data on Etherscan shows.

Blockchain message from the exploiter on Friday (Etherscan)
Blockchain message from the exploiter on Friday (Etherscan)

CRV, the governance token of Curve, jumped on the news and is up 5% over the past 24 hours.

The transactions spur hope that most of the stolen assets will be recovered to victims in one of the most dramatic crypto exploit this year. Curve, Metronome and Alchemix lost $61.7 million of crypto assets over the weekend when an unknown hacker exploited a coding bug to loot multiple trading pools.

On Thursday, the affected protocols offered a 10% bounty for returning the assets by Aug. 6, CoinDesk reported.

The Curve exploit roiled the decentralized-finance sector as anxious investors yanked out assets as a precaution. CRV token's price fell as much as 31% to 50 cents in the aftermath.

The plunge put Curve founder Michael Egorov's loans secured with $168 million CRV at risk of liquidating. A liquidation would have left lending protocols like Aave in distress with tens of millions in bad debt.

To avoid the near-catastrophe, Egorov sold roughly $42 million of his CRV stash including to crypto entrepreneur Justin Sun, founder of the Tron blockchain, in over-the-counter deals to pay off loans.

UPDATE (Aug. 4, 15:01 UTC): Updates total assets returned until publication. Adds context about the exploit and its aftermath.

Edited by Oliver Knight.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Krisztian  Sandor

Krisztian Sandor is a reporter on the U.S. markets team focusing on stablecoins and institutional investment. He holds BTC and ETH.