Calling All Crypto Sleuths! Curve Finance Extends Attractive $1.85M Bounty

Curve Finance has taken a bold step to combat recent security breaches. Just last week, a mysterious exploiter managed to drain a staggering $61 million from its pools, sending shockwaves through the crypto realm.

But the story does not end there. In a surprising twist, Curve Finance, along with other affected protocols (Metronome and Alchemix), made a daring move to regain control. Just a couple of days later, they put forth an unprecedented 10% bug bounty offer to the cunning hacker, amounting to a jaw-dropping sum of over $6 million.

Remarkably, the gambit worked. The hacker returned a portion of the pilfered assets to Alchemix and JPEGd within a mere 24 hours of the bug bounty offer's announcement. A substantial sum of 4,820.55 Alchemix ETH (alETH) was sent back to the Alchemix Finance team, setting the wheels of restitution in motion. The process culminated on August 5 when the transaction was successfully completed.

All-Out Taunting or Just Bitter?
The unfolding drama took an intriguing turn when the attacker shared a cryptic message, seemingly directed towards the Alchemix and Curve teams. Within the enigmatic note, a perplexing motive surfaced — the individual professed a willingness to return the funds, but a curious caveat emerged. The driving force behind the decision appeared to be the desire not to "ruin" the projects involved.

The on-chain messages reads, “I’m refunding not because you can find me, it’s because I don’t want to ruin your project.”

JPEG'd also received a refund, solidifying the return of 5,495 Ether by the hacker responsible for the security breach. As a remarkable gesture, the protocol has decided to forgo any legal action against the perpetrators, potentially opening the door to a unique resolution that prioritises collaboration and reconciliation.

​​The team from JPEG’d expressed, “Any further investigations or legal matters against the entity will end. We view this occurrence as a white-hat rescue.”

REWARD: $1.85M for Anyone Who Can Identify the Exploiter
However, there are still unanswered claims awaiting resolution in the other affected pools. With the deadline now behind us, the spotlight turns to the broader crypto community. An opportunity awaits anyone who can uncover the identity of this elusive attacker. A bug bounty valued at an astonishing $1.85 million, is up for grabs as a commendation for solving this intricate riddle.

The on-chain message reads, “The deadline for the voluntary return of funds in the Curve exploit passed at 0800 UTC. We now extend the bounty to the public, and offer a reward valued at 10% of remaining exploited funds (currently $1.85M USD) to the person who is able to identify the exploited in a way that leads to a conviction in the courts…if the exploiter chooses to return the funds in full, we will not pursue this further."

What Does the Partial Return of Funds Mean?
The return of a substantial portion of the stolen funds indicates a fascinating shift in the hacker's stance — a possible desire for redemption or reconciliation, or an arrogant move showing that they can do whatever they want? The intriguing intricacies deepen as we observe the method of restitution. The decision to return the funds to Alchemix Finance, rather than directly to Curve Finance, adds a layer of complexity that begs further exploration. Could this choice reflect a strategic manoeuvre, carefully calculated to exploit perceived vulnerabilities within the two protocols? Or does it reveal a certain level of discretion and discernment on the part of the hacker?

This is more than a mere hunt for a malicious actor; it is a test of collective strength and solidarity within the decentralised finance (DeFi) realm.