Curve CRV/WETH Exploit
Recent developments have revealed an exploit in Curb and various defi protocols. The exploiters took advantage of a zero-day vulnerability within the Vyper compiler, which is popularly used for various smart contracts. This flaw enabled the attackers to exploit several Ethereum liquidity pools, namely peth-eth, crv-eth, alETH-ETH, and msETH-ETH.
The total amount illicitly withdrawn from all these pools is estimated to be around $70 million, with the exploiters believed to have pocketed approximately $50 million. The remaining $20 million is estimated to have been secured by white-hat hackers.
In this dashboard, we will scrutinize the exploiter's activities concerning the crv-eth pool. We will delve into the specifics of the transactions they used to exploit the pool, the profits they made from this exploit, and the method and timing of the pool liquidity drainage.
The graphic representations below will provide a detailed depiction of these activities. Our data reveals that nearly $20 million was pilfered from this pool. Breaking it down further, CRV tokens accounted for around $5 million of the stolen assets, while the rest - approximately $15 million - were Wrapped Ethereum tokens.
The exploitation took place over several hours, during which the entire pool liquidity was drained. The bulk of the liquidity was extracted by a single wallet in the transactions detailed below. However, numerous other entities managed to retrieve value from the pool, many of these being MEV bots.