Alchemix, a lending marketplace, has declared that the Curve Finance hacker has returned all of the money that was taken. Over $61 million worth of cryptocurrencies were lost in the attack on July 30. This amount included $13.6 million from Alchemix’s alETH-ETH pool.
JPEGd’s pETH-ETH pool and Metronome’s sETH-ETH pool both had outflows of approximately $11.4 million, along with Alchemix. Using reentrancy attacks and weak versions of the Vyper programming language, the hacker targeted Curve Finance’s stable pools.
After the hacker accepted a bug bounty offer, the money started to be returned. On August 3, Curve, Metronome, and Alchemix together announced an endeavour to recover stolen monies. They offered a 10% bounty of the money that had been taken as a prize and pleaded with individuals who had carried out the exploit to return the other 90%, which would have brought the bounty close to $7 million.
Less than 24 hours following the offer, the initial attacker started repaying money that had been taken a few days earlier. They sent 4,820.55 Alchemix ETH (alETH) to the Alchemix Finance team first, and then on August 5, they completed the transaction.
The attacker claimed to be willing to repay the payments but only because the individual didn’t want to “ruin” the projects involved destroy the post, which appears to have been addressed to the Alchemix and Curve teams“I’m refunding not because you can find me, it’s because I don’t want to ruin your project,” He said
JPEG’d, a nonfungible token protocol, has also been reimbursed, demonstrating that the hacker has returned 5,495 Ether. The protocol will not pursue legal action against the offenders as part of the bounty offer.
“Any further investigations or legal matters against the entity will end. We view this occurrence as a white-hat rescue,” the JPEG’d team stated.