Link copied 
Curve Finance, a platform in the decentralized finance (DeFi) sector, suffered a significant setback on July 30 when a hacker managed to siphon off more than $61 million from various pools. Fast forward to August 3, and the platform, together with other impacted parties, presented a lucrative proposition to the perpetrator: return the stolen assets and receive a 10% reward.
While this might sound like an unconventional approach, it had partial success. The anonymous hacker returned the stolen amounts to both Alchemix and JPEGd. However, many other affected pools didn't see their funds returned.
Once the stipulated period for voluntary returns elapsed, Curve made another move. They reached out to the global community with an enticing offer. In an on-chain announcement, the platform declared that anyone who could pinpoint the hacker's identity, leading to legal action and conviction, would receive a reward of $1.85 million, which amounts to 10% of the unreturned assets.
Earlier on, the hacker had communicated with Alchemix and Curve. In an on-chain note, they stated that their intention to refund wasn't out of fear of being caught. Instead, they expressed a desire not to destroy the platforms.
On the fateful day of the attack, over $61 million in digital currencies vanished from Curve's custody. Breakdowns include $13.6 million from Alchemix’s alETH-ETH pool, $11.4 million from JPEGd’s pETH-ETH, and $1.6 million from Metronome’s sETH-ETH. Technical experts pointed fingers at the Vyper programming language's vulnerable versions, which the hacker exploited through reentrancy attacks.
This incident has laid bare the potential security issues that DeFi platforms face, triggering an industry-wide scramble to secure and retrieve stolen assets in the following days.
