Curve LlamaLend Hack
What happened
On March 2, 2026, an attacker exploited Curve LlamaLend's sDOLA/crvUSD market on Ethereum. The transaction forced 27 positions into soft liquidation and then inflated the sDOLA vault’s share price, making the positions immediately eligible for hard liquidation. The attacker’s realized profit was reported at roughly $240,000, while the LlamaRisk post-mortem estimated borrower losses at approximately 822,475 crvUSD; those figures describe different outcomes and are not interchangeable.
The market accepted a vault-share collateral price that could be increased permissionlessly within the same transaction, and its liquidation flow could be combined with a large LLAMMA exchange to move borrowers into a vulnerable state. Collateral integrations need manipulation-resistant valuation, limits on same-block rate changes, and liquidation assumptions tested against atomic capital and vault donations.
How it happened
- The attacker flash-borrowed about $46 million of capital, acquired crvUSD through several routes, and exchanged 13.25 million crvUSD through the LLAMMA AMM, pushing every active sDOLA/crvUSD position into soft liquidation.
- They then redeemed sDOLA and used the permissionless DolaSavings staking path to donate DOLA into the vault.
- That raised the vault’s assets-per-share rate inside the transaction, so the collateral valuation used by the lending market jumped while the borrowers were already soft-liquidated.
- The attacker hard-liquidated 27 positions, used seized collateral to open a leveraged position, settled the flash financing, and left a profit estimated near $240,000.
- Curve’s subsequent compensation discussion identifies the borrower-side loss separately from the attacker’s proceeds.
Protocol details
Evidence
Proof of concept
1 available- Code Curve LlamaLend
Sources
- report Twitter/X Alert x.com
- report @hklst4r incident report x.com
- report @Phalcon_xyz incident report x.com
- report LlamaLend sDOLA market postmortem llamarisk.com
- report LlamaRisk sDOLA-long2 post-mortem gov.curve.finance
- transaction Etherscan exploit transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Curve DAO borrower recompense proposal gov.curve.finance
- analysis BlockSec weekly security incident roundup blocksec.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
