Lending platform Alchemix has announced the return of all stolen funds by the Curve finance hacker. The attack took place on July 30 and resulted in over $61 million in cryptocurrencies drained, including $13.6 million from Alchemix\u2019s alETH-ETH pool.\u00a0<\/p>\n
Along with Alchemix, JPEGd\u2019s pETH-ETH pool saw outflows of $11.4 million, and Metronome\u2019s sETH-ETH pool was drained in over $1.6 million. The hacker targeted stable pools on Curve Finance using vulnerable versions of the Vyper programming language through reentrancy attacks. <\/p>\n
The return of funds started after the hacker accepted a bug bounty offer. Curve, Metronome and Alchemix jointly announced an initiative to recover stolen funds on Aug. 3, offering a 10% bounty of the seized funds as a reward, and urging those responsible for the exploit to return the remaining 90%, which would bring the bounty close to $7 million.<\/p>\n
Related – Curve-Vyper exploit: The whole story so far<\/em><\/strong><\/p>\n In less than 24 hours after the offer, the original attacker began returning funds stolen a few days earlier, initially sending back 4,820.55 Alchemix ETH (alETH) to the Alchemix Finance team, before completing the transaction on Aug. 5<\/p>\n The attacker posted a message that seems to have been directed at the Alchemix and Curve teams, claiming to be willing to return the funds but only because the person didn\u2019t want to \u201cruin\u201d the projects involved. <\/p>\n “I’m refunding not because you can find me, it\u2019s because I don\u2019t want to ruin your project,” reads the on-chain message.<\/p>\n Nonfungible token protocol JPEG\u2019d has also been refunded, confirming that 5,495 Ether has been returned by the hacker. As part of the bounty offer, the protocol will not take legal action against the perpetrators. <\/p>\n \u200b\u200b\u201cAny further investigations or legal matters against the entity will end. We view this occurrence as a white-hat rescue,\u201d the JPEG\u2019d team stated.<\/p>\n