DEX Curve Finance has offered a $1.85m reward for identifying the hacker who breached the platform and bringing him to justice.
The deadline for voluntary restitution of the Curve exploit funds has passed. The exchange said it is now widening the reward to the public and offering 10% of the hacker’s remaining funds (now $1.85m).
On July 30, an unknown attacked Curve’s stablecoin pools, exploiting a vulnerability in the Vyper code. Initially, total losses from the hack were estimated at $47m. According to Defi Llama, the sum has risen to $61.7m.
In early August the hacker partially returned the funds, transferring assets valued at more than $20m to the JPEG’d and Alchemix projects. The attacker received the promised 10% reward of the amount.
Curve said that if the hacker fully reimbursed the stolen funds, they would drop the case.
In a transaction message to Alchemix, the attacker explained that the decision to return the assets was not fear of being caught, but a reluctance to destroy the project.
Perhaps to many people this is a lot of money, but not for me. Damn, I’m smarter than all of you, he wrote.
JPMorgan analysts concluded that the consequences for the DeFi ecosystem from the Curve attack appear to be localized.