Curve Finance Hack Incident Analysis

At ~4:20 PM EST on 2022-08-09 Curve Finance's DNS was hijacked and pointed to a cloned site with malicious frontend code that convinced users to approve an unverified contract; seven victims lost about $612,724 in stablecoins which the attacker swapped to ~362 ETH and moved to FixedFloat, Tornado Cash, Binance and other addresses. The report provides on-chain tracing, notes this is a Web2-to-Web3 vector (DNS/frontend compromise), and highlights the importance of quick disclosure to enable exchanges to freeze stolen funds.