Curve DEX Hack

On August 9, 2022, an attacker hijacked the DNS of Curve Finance's main frontend, curve.fi, and pointed it at a cloned site. The clone asked visitors to approve token spending by a malicious, unverified contract, which the attacker then used to pull USDC and DAI from the wallets that approved it. Curve's smart contracts were not affected.

Curve founder Michael Egorov said the nameservers of its DNS registrar, iwantmyname, had been compromised, not Curve's own registrar account. Curve moved users to its unaffected curve.exchange domain, told anyone who had approved contracts in the past few hours to revoke them, and reverted the hijack within hours.

Loss figures differ. Rekt put it at about 340 ETH (~$575k). CertiK counted $612,724 in USDC and DAI taken from seven victims. The attacker converted the stablecoins to about 362 ETH and moved it on:

• 292 ETH to FixedFloat, which froze 112 ETH
• 20 ETH to Binance
• 27.7 ETH to Tornado Cash

On August 12, Binance CEO Changpeng Zhao said the exchange had frozen or recovered about $450k of the stolen funds, which Decrypt described as more than 83% of the theft. Binance said it was working with law enforcement to return the funds to users.

Malicious contract: [0x9eb5f8e83359bb5013f3d8eee60bdce5654e8881](Address 0x9eb5…8881)

Attacker: [0x50f9202e0f1c1577822bd67193960b213cd2f331](Address 0x50f9…f331)

Example drain transaction: [0x525fb894...](Tx 0x525f…a5e4)