On July 30, a cyberattack hit Curve Finance, resulting in a loss of $61 million. The attacker, however, has taken a surprising turn by returning 4,820.55 Alchemix ETH (alETH), worth around $8,889,118, and 1 ETH to the Alchemix Finance team, alongside a donation of roughly $1,844 to the Curve Finance team. The assault exploited a reentrancy vulnerability within the Curve Finance protocol, affecting several pools including Alchemix Finance alETH-ETH, JPEG'd pETH-ETH, and Metronome sETH-ETH. The JPEGpool , specifically, saw miner-extractable value (MEV) bots intervene, channeling the attack proceeds to the bots rather than the attackers.
The emergency multisig wallet responded by suspending all rewards for the affected pools on August 2. Although the initial breach was valued at $47 million, an updated estimation placed the damage at $61.7 million. In an unexpected twist on August 4 at 3:4 5pm UTC, The attackers released a message on the Ethereum network seemingly directed at the Alchemix and Curve development teams. The message conveyed their intention to return the funds, not because of being caught, but to avoid "destroying" the targeted project.
The attacker initiated the return process by transferring 1 altETH to the Curve Finance deployer account at 11:16 AM UTC. Subsequently, within two hours, they carried out three separate transfers, totaling 4,820.55 altETH, to the multisig wallet of the Alchemix development team. The total sum reclaimed amounted to approximately $8.9 million, equivalent to around 15% of the initial loss. It should be noted that some funds may have taken an alternate route and could have been restored in a distinct transaction.
MEV bots in control of the JPEG pool assault might also be considering returning the funds. One of these bots posted a message at 6:47 AM UTC, hinting at ongoing communication with a developer through email for potential resolution. As of now, however, no conclusive evidence points to any verifiable return of funds by the bot owner to a developer account.
