Nearly $10 Million of the Curve Exploit Was Returned (Here’s Why)

TL;DR

• Last weekend, hackers found an exploit in Curve, a decentralized cryptocurrency lending platform.

• The good news is: almost $10 million was returned after the hacker(s) talked to one of the victims, blockchain, on Friday data shows.

• In a post linked to this transactionthe hacker asked Alchemix (one of the victims) to confirm the wallet address where he could return the money.

• The most likely reason for returning the money – at least in our mind – is that they made a deal with the team responsible for Curve’s governance, and that deal included returning some of the money.

Full story

Last weekend, hackers found an exploit in Curve, a decentralized cryptocurrency lending platform.

We wrote about it here – and to quote ourselves…

Hackers have found a bug that gives them instant access to huge lending pools, and a total $100 million worth of crypto is at risk, with an estimated $50 million stolen at the time of writing (July 31).

As things progressed, approximately $61 million was eventually stolen through the Curve exploit.

The good news is: almost $10 million was returned after the hacker(s) talked to one of the victims, blockchain, on Friday data shows.

How do you communicate anonymously?

Through blockchain transactions, of course!

In a post linked to this transactionthe hacker asked Alchemix (one of the victims) to confirm the wallet address where he could return the money.

After that, almost $10 million was transferred to Alchemix’s wallet in multiple transactions.

Which begs the question: why the sudden change of heart to return the money?

We have a few theories that go something like this:

1. The least likely, but most sound theory is that the hackers were white hat hackers. They did the hack to improve the protocol in general. A ‘white hat’ hacker is a bit like Superman, to Lex Luthor of a ‘black hat’ hacker – they use their (hacking) powers for good.

2. They may have been shocked and returned the money in good conscience; or changed their mind after talking to at least one of the victims and hearing their story. (Also quite unlikely).

3. The most likely option – at least in our mind – is that they struck a deal with the team responsible for Curve’s governance, and that deal involved some of the money being refunded.

The real reason may come out later this week.

Let’s hope the exploit is now fully fixed and it doesn’t happen again!