Curve Finance Hacked, $570k Stolen!

Table Of Content

Share:

On Tuesday, 9th August, Curve Finance suffered from a DNS attack causing theft of a whooping $570,000+ USD. 

Curve Finance is a stablecoin decentralized exchange (DEX) that runs on the Ethereum blockchain. 

The attacker targeted the front end where the suspected hacker appears to have changed the domain name system (DNS) entry for the protocol, forwarding users to a fake clone website and approving a malicious contract. The program’s contract remained uncompromised, however.

The team behind the protocol noticed the issue and tweeted to warn the users about the exploit. 

A few hours after the exploit Curve again tweeted confirming both that they have found the issue and also reverted it. They also asked the user to immediately revert any contract they have approved on Curve prior. 

Curve explained that it was most likely that the DNS server provider Iwantmyname was hijacked. On the other hand, the exploit was going on, Twitter user LefterisJP speculated that the alleged attacker had likely utilized DNS spoofing to execute the exploit on the service. 

Other users quickly noticed and tweeted to warn the users that the alleged thief appears to have stolen more than $573,000 USD. 

Also read, GAMEFI: FUTURE OF GAMING OR SHORT-LIVED GIMMICK?

More Audits

Infiltrating the EVM-II: Inside the War Room's Arsenal

War Room is an immersive, high-energy environment incorporating a dedicated team of experts that comes together to form the backbone of the War Room. Read more in this part

Dafi V2 Super Staking Audit Report

BlockApex conducted smart contract audit for Dafi v2 protocol. This document presents the findings of our analysis which took place from 16th Dec 2021 to 14th Jan 2022.

Lightlink Bridge - Audit Report

BlockApex (Auditor) was contracted by LightLink (Client) for the purpose of conducting a Smart Contract Audit/ Code Review. This document presents the findings of our analysis, which started on 12th June ‘2023.

KaliDAO Audit Report

BlockApex (Auditor) was contracted by KaliCo LLC_ (Client) for the purpose of conducting a Smart Contract Audit/Code Review of KaliDAO. This document presents the findings of our analysis which took place from 20th of December 2021

Sonar Bridge V2 Initial Audit

BlockApex (Auditor) was contracted by SONAR (Client) for the purpose of conducting a Smart Contract Audit/Code Review for Sonar Bridge V2. This document presents the findings of our analysis which took place on 28th September 2021.

LightLink Token Transfer Bridge Architecture Threat Modeling

This comprehensive threat analysis report provides an in-depth review of potential security vulnerabilities within the LightLink Token Transfer Bridge Architecture. Through rigorous application of both the STRIDE and ABC threat modeling frameworks, the report identifies key system weaknesses and offers strategic mitigation recommendations.

Lightlink Bridge: BlockApex WhiteBox Code Review Report

the source code review of Lightlink Bridge Validator and Keeper. The purpose of the assessment was to perform the whitebox testing of the Bridge’s validator and Keeper before going into production and identify potential threats and vulnerabilities.

Unipilot Farming Audit Report

BlockApex (Auditor) was contracted by Voirstudio (Client) for the purpose of conducting a Smart Contract Audit/Code Review of Unipilot Farming module. This document presents the findings of our analysis which took place on   _9th November 2021___ . 

Infiltrating the EVM-I: Demystifying Smart Contracts & Auditing

Infiltrating the EVM-I: Demystifying Smart Contracts & Auditing comprises of information about compilation breakdown of solidity code, the vulnerable components of blockchain ecosystem and how Smart contract auditing is crucial.

1 2 3 11
Designed & Developed by: 
All rights reserved. Copyright 2023