A hacker who stole up to $73.5 million, mostly in ether, from DeFi lending protocol Curve, has returned around $52.3 million of the stolen funds.
The funds were returned after Curve sent the hacker a message telling them they could keep 10% if they returned the rest. The hacker agreed and, apparently, even made sure to communicate with Curve operators to confirm that the address given for the refund was correct.
These communications were made on the Ethereum blockchain, which can be used to send written messages. The funds were returned just in time as Curve founder and CEO Michael Egorov risked getting liquidated on an $85 million loan backed by $168 million worth of CRV tokens.
Egorov’s liquidation is estimated to happen when CRV dips below $0.4. He’d previously avoided liquidation by selling CRV tokens to various crypto investors including Tron’s Justin Sun and Machi Big Brother. The current price of CRV is at $0.62 but momentarily fell below $0.5 last Tuesday.
Curve founder dumps CRV on Justin Sun to avoid liquidation
Read more: Curve exploit shows DeFi still far from decentralized in 2023
Curve is a decentralized exchange and finance protocol with various liquidity pools focusing mostly on the exchange of stablecoins. Investors could pool in their crypto and stablecoins at generous interest rates to sustain the lending protocol.
It has a total of $2.398 billion worth of crypto locked as collateral for loans and up to 89,423 users on the Ethereum blockchain. It reached a peak of more than $23 billion in total funds locked in January of last year and a low of $1.8 billion right after it was hacked.
The protocol is now recovering and trading activity is increasing, however, it’s still relatively low compared to the previous years.
Curve hacker isn’t in the clear yet
Despite Curve’s hacker agreeing to return a portion of the stolen funds, the company is still offering a $1.85 million bounty to anyone who can identify them in a way that leads to legal action.
Curve wrote in Ethereum input data: “The deadline for the voluntary return of funds in the Curve exploit passed at 0800 UTC,” (via The Block).
“We now extend the bounty to the public, and offer a reward valued at 10% of remaining exploited funds (currently $1.85M USD) to the person who is able to identify the exploiter in a way that leads to a conviction in the courts.”
