Swerve Finance Hack

In March 2023 an attacker tried to take over Swerve Finance, a defunct Curve Finance clone on Ethereum, through its own governance. Starting on March 16, 2023, the attacker created DAO votes that would have handed control of the protocol's funds, about $1.3 million in stablecoins in the DAI-USDC-USDT pool, to an address they controlled.

The attack relied on the protocol being abandoned. With few active voters left, anyone holding enough vote-escrowed SWRV (veSWRV) could try to pass a proposal. The attacker began with about 348,000 governance tokens and was later joined by a second address holding about 102,000 more. That was still not enough: reports put the attackers' voting power at about 495,000 veSWRV against about 571,000 needed, so the proposals failed. By March 24 the attacker had tried several times over more than a week. Opened sources report no funds leaving the pool.

Wintermute's head of research, Igor Igamberdiev, publicly linked the attempt to a specific address and Twitter user using on-chain timing analysis. The alleged party had claimed the effort was a whitehat attempt to claim about $120,000 in admin fees, and that exposure of the $1.3 million was accidental. That attribution and claim are unproven. Igamberdiev suggested moving ownership to a null address so no future proposal could take the funds.

Attacker address: 0xcdedb901181b4b90181424ff581b627805186ca7

Malicious vote transaction: 0x4c612aeaddb9f534bcb500e8c4ef8d6171efda9841bce716349cc1fb4275a2fa