Curve Finance Breach: Exploiter Launders $4.6 Million via Tornado Cash

In July 2023, Curve Finance, a leading DeFi protocol, suffered a major security breach. The attacker transferred roughly 1,500 ETH (worth about $4.6 million) to a new address, 0xc772…7475, according to PeckShieldAlert data.

The funds were then laundered through TornadoCash, a privacy-focused service, raising concerns within the crypto community.

In addition to the substantial ETH transfer, a whale liquidation occurred, with address 0x929d…2af1 liquidated for approximately 456 WETH (valued at around $1.34 million). These events underscore the ongoing challenges and risks in the DeFi space, emphasizing the need for robust security measures and monitoring systems.

The exploiter-related address 0xc772…7475 continues to launder funds through TornadoCash. Over 1,500 ETH, equivalent to roughly $4.6 million, has already been laundered.

The use of TornadoCash to obscure transaction details complicates the tracking and recovery of stolen assets. This laundering activity has sparked calls for increased scrutiny and regulation of privacy-focused services within the crypto industry.

The Curve Finance breach also exposes potential vulnerabilities in DeFi protocols. In response, @Cyvers_ has promoted its address reputation product, designed to help users detect the source of malicious funds and enhance security. Interested parties can book a demo to learn more.

The incident underscores the importance of vigilance among crypto users. As Cyvers Alerts noted, an address poisoning transaction occurred, where a victim mistakenly sent 56.6K USDC to a malicious address.

The attacker quickly swapped the stolen funds to DAI and deposited them into Railgun, further hindering recovery efforts. This incident serves as a stark reminder for users to double-check transaction details and verify the legitimacy of addresses.