Wintermute Hacker Controls 51% of Curve Finance's 3pool Liquidity

Following the dramatic events of the past week, Curve Finance finds itself in a precarious situation with recent developments adding to the AMM platform's challenges.

Hacker Dominates 3pool Liquidity:

• Key Issue: The hacker responsible for the Wintermute breach now controls over 51% of the 3pool liquidity on Curve Finance, causing significant concern within the DeFi community.

Background:

• Wintermute Hack: In September 2022, a hacker stole $160 million from market maker Wintermute. The hacker quickly deposited the stolen funds into Curve’s 3pool (comprised of USDT, USDC, and DAI) to avoid stablecoin issuers freezing the assets.
• Liquidity Shift: By April 2023, the hacker’s share in the pool had grown to around 30%. However, recent market exploits and stablecoin-related FUD have reduced the overall liquidity in the 3pool, pushing the hacker’s share to over 50%.

Impact:

• Liquidity Concerns: The increasing dominance of the hacker in the 3pool has raised alarms about potential risks, including destabilization and manipulation of the pool.

Community and Security Responses:

• Reward for Hacker Identification: Despite efforts to identify the hacker, including a 50,000 ARKM reward from Arkham, the hacker remains unidentified.

Updates on Curve Finance:

• Founder’s Loan Positions: Curve Finance founder Michael Egorov has another loan on Cream Finance, collateralized by CRV, worth approximately $2.5 million with a health factor of 2.23.
• OTC Sales: Egorov has sold 143.65 million CRV tokens OTC, raising $57.46 million to stabilize his DeFi loan positions and prevent liquidation.

Bounty and Liquidity Shifts:

• Bounty Offer: Curve Finance has announced a $1.85 million bounty for identifying the hacker responsible for the CRV-ETH pool exploit.
• Liquidity Migration: Curve is considering shifting liquidity from the CRV-ETH pool to the TriCRV pool to mitigate liquidity issues and reduce the risk of a CRV token sell-off if the hacker does not return the stolen funds.

The control of over 51% of Curve Finance's 3pool liquidity by the Wintermute hacker poses a significant threat to the stability of the DeFi platform. Ongoing efforts by Curve Finance and the broader community aim to address these risks and ensure the security and stability of the ecosystem.