Curve Finance offers hacker 10% bounty, agrees not to seek legal assistance if offer is taken up

Curve Finance and two other DeFi platforms offered a bounty on Aug. 3 in exchange for the return of funds stolen in various recent attacks.

Curve, Metronome, and Alchemix wrote:

“We as a group … would like to discuss a bounty with any parties who were involved in the recent Curve exploits. We are offering a 10% bounty of any funds stolen, which are yours to keep if you return the remaining 90%.”

The three projects said that if the attacker or attackers return the stolen funds, they will not pursue the issue further or turn to law enforcement.

However, they said that if the attackers do not come forward voluntarily by Aug. 6, the 10% bounty will be offered to anyone who can identify the responsible parties in a way that leads to their conviction in court. The three DeFi platforms said that they will “pursue [the attacker] from all angles [within] the full extent of the law.”

The message was signed by the decentralized exchange Curve, the synthetic asset protocol Metronome, and the same-asset loan platform Alchemix.

Curve Finance broadcast the message on Twitter/X on Aug. 3, writing: “Dear hacker, you’ve got an incoming message.” The full text of the message is embedded on-chain in a linked Ethereum (ETH) transaction.

Attacks extend beyond Curve

Curve Finance was originally hacked on July 30, during which an attacker stole $60 to $70 million from the platform. The attack was made possible by a vulnerability in Vyper smart contracts, which also allowed for other attacks elsewhere.

According to Llamarisk via TechCrunch, Alchemix’s alETH pools were hacked for $22.6 million, while Metronome’s msETH pools were hacked for $3.4 million.

As such, Curve’s latest announcement also linked to an identical bounty for the Alchemix hacker. It did not link to any bounty offered to the Metronome hacker, though such a bounty is implied by the fact that Metronome signed the message.

The widespread scope of these recent hacks has led to a decline in total locked value (TVL) in DeFi platforms. On Aug. 2, CryptoSlate found that investors and liquidity providers have pulled more than $3 billion from DeFi services.

In the last three days, the DeFi sector has seen an 8% decline in the total value of locked assets (TVL), falling to $40.31 billion, as per DeFiLlama data.

As of July 30, DeFi projects TVL stood at $43.81 billion but witnessed a sharp decline after malicious players attacked several Curve (CRV) pools on July 31. Following the attack, crypto investors began withdrawing their assets, totaling over $3 billion, across different protocols as contagion fears emerged.

Source: DeFiLlama

Curve and Convex dominate losses

According to DeFiLlama data, two DeFi protocols—Curve Finance and Convex Finance—account for about two-thirds of the drop, with their TVLs falling by more than $1 billion each during the last three days.

Curve and Convex, two of the most prominent DeFi protocols in the crypto market, have a significant relationship, given that Convex enables users to tap into liquidity and generate earnings from Curve’s stablecoin pools.

At their peak, the protocols had a combined TVL of more than $40 billion as they attracted millions of users to the sector.

Meanwhile, the decline was not restricted to these two protocols as others, including UniSwap (UNI), Aave (AAVE), and others, also saw losses following the incident. However, DeFiLlama data shows these platforms have posted mild recoveries from the fall during the last 24 hours.

Lenders are pulling liquidity

The TVL decline can also be attributed to lenders pulling their liquidity from DeFi platforms as the uncertainty in the industry continues to spread.

As an immediate response to “mitigate contagion risks,” Auxo DAO, a decentralized yield-farming fund, announced it had “promptly removed” all its position on Curve and Convex.

Besides that, Curve Finance founder Michael Egorov has about $100 million in loans on different DeFi platforms backed by 427.5 million CRV (47% of total CRV supply), prompting fears of bad debt should CRV’s price drop below a certain threshold.

According to crypto research company Delphi Digital, the size of Egorov’s position could potentially trigger knock-on effects across a major part of the DeFi ecosystem.

DeFi platforms like Aave have already experienced significant withdrawals because of these fears. The platform is seeing a surge in borrowing fees and interest rates, intensifying the liquidation risk for users with outstanding loans.

Meanwhile, Egorov has sold CRV to investors and institutions via OTC deals to pay off the debt and prevent liquidation.