Kaiko Research goes Premium.

Loans, Buy Walls, and OTC Deals: The Curve Finance Exploit

Curve

CEX

DeFi

Written by Riyad Carey

03/08/2023

Welcome to Deep Dive!

Curve Finance is back as the center of attention in DeFi just a few weeks after CEO Michael Egorov’s large CRV-backed loans drew scrutiny. This time, however, the inciting incident was an exploit.

  • CRV and AAVE open interest surged as funding rates turned negative

  • About $70mn worth of tokens were stolen

  • Bids increased on centralized exchanges

  • The exploiter still holds 7mn CRV tokens

Rekt and Llama Risk have done a nice job breaking down the technical aspects of the exploit. For our purposes it’s most important to know that three Curve pools – alETH-ETH, pETH-ETH, and CRV-ETH – were drained of about $70mn worth of tokens and that the exploiter currently holds over 7mn CRV tokens. 

In the grand scheme of DeFi exploits this one was relatively small – about 10 times smaller than the largest ever. What makes it interesting is its effect on Egorov’s loans and various DeFi protocols. I covered the loans in-depth in a Deep Dive a few weeks ago, and I recommend reading it before this for background. This Deep Dive will cover the exploit, the fallout, and what might happen next.

the exploit

Focusing on the CRV-ETH pool, the exploit looked like this:

The attacker deposited 400 ETH (the single positive orange circle) and withdrew millions of dollars worth of tokens in a single transaction. It’s shown as numerous orange circles above because the tokens were removed in about 60 clips within a single transaction.

With the vast majority of liquidity removed from its largest on-chain liquidity source, CRV’s price quickly fell below $0.10 on Curve and below $0.25 on Uniswap.

Importantly, however, CEX prices remained stable, allowing oracles to filter out divergent prices and preventing Egorov’s loans from being liquidated.

Never miss an analysis.

Subscribe to our free weekly Data Debrief email, or learn more about our premium research subscriptions here.

fallout

Almost immediately after the exploit was spotted CRV’s open interest (OI) began to climb, doubling from $30mn to $60mn in just six hours. As OI began a second leg up, the volume weighted funding rate (VWFR) dropped from slightly positive to -0.08%, then to -0.25%, a sign that there was heavy shorting.

As the implications of Egorov’s potential liquidation became clearer (this is also discussed in the aforementioned Deep Dive), AAVE’s funding rate turned negative as OI climbed from $35mn to a high of $50mn. 

However, the most interesting activity came in spot markets. Normally following an exploit, we see liquidity drop as a token’s price falls and market makers reduce exposure amidst uncertainty. This time, we saw the opposite.

Bid depth within 0.5% of the mid price was volatile, but there was a clear trend further from the mid price. Bids within 4% doubled from $1.5mn to $3mn, with Binance accounting for about $1mn of this surge. Such a significant surge concentrated on a single exchange suggests that a party or parties were putting up buy walls for CRV.

On-chain, $500mn worth of tokens were withdrawn from Aave V2 in just 3 hours. Excluding two very large flash loans (each depositing $200mn to profit just 0.4 ETH), about $2bn has been withdrawn from the protocol while $1bn has been deposited.

As a result of these outflows, Aave V2’s USDT and USDC borrow rates jumped from under 4% and are currently resting between 13% and 18%. Egorov is currently borrowing $50mn USDT from Aave V2; higher interest rates are not helping the health of his loan.

dead reckoning

What happens next is unclear, but Egorov has already taken some clever measures to prevent liquidation. As we’ve written in the past, Curve is favored by whales, with an average trade size many multiples higher than on Uniswap. Its close relationship to whales – and earned respect amongst the Ethereum builder crowd – seems to have come in handy as Egorov has been selling off millions of CRV in OTC transactions at $0.40, including to Justin Sun, Yearn Finance, and Stake DAO. Aave governance is currently considering whether to buy 5mn CRV tokens. This is a win-win arrangement where Egorov gets much needed stablecoins and OTC buyers get cheaper CRV while also reducing the likelihood of broader DeFi contagion.

This fresh liquidity coincided with his reducing the size of the Aave V2 loan on Wednesday morning, repaying about $9mn of USDT and withdrawing about $22mn of CRV.

However, Egorov’s Fraxlend loan, which was about $15mn FRAX last month, carries the highest interest rate because of a unique multiplier mechanism. To combat this, Egorov created a fFRAX-crvUSD Curve pool, then incentivized the pool with CRV tokens. fFRAX is a token generated by depositing FRAX on Fraxlend. Thus, the creation of this heavily incentivized pool encouraged users to deposit FRAX on Fraxlend then deposit the fFRAX – paired with crvUSD – on Curve. This had the intended effect of increasing FRAX deposits, thus lowering utilization and decreasing Egorov’s interest rate. This has bought him some time to pay off the loan before its size grows significantly. 

This got a new wrinkle when Abracadabra – where Egorov has borrowed $10mn MIM – proposed significantly increasing interest rates, though this proposal appears to have failed as of this writing. Essentially, lending and borrowing protocols are jockeying to get repaid first. Fraxlend appears to be in the lead because of its high interest rate, though this could change quickly. 

Protocols getting saddled with bad debt was always likely with loans of this size backed by illiquid tokens. However, bad debt would be a virtual certainty now given that most on-chain CRV liquidity is gone. Most concerning is that the exploiter holds 7mn CRV tokens and thus significant leverage over CRV’s price.

Data Used In This Analysis

  • Asset Metrics

    Aggregated trade and order book data across all exchanges

  • DeFi Data

    Liquidity events and lending and borrowing events

  • Trade Data

    Tick-level transaction data from 100+ exchanges

More From Kaiko Research

  • Bitcoin

    07/10/2025 Data Debrief

    Is Wall Street Driving BTC Prices?

    BTC crossed $125k for the first time over the weekend as markets rose across the board last week. Following BTC’s latest record run, we’re exploring BTC’s price drivers and price discovery mechanisms. In particular, we look at the role of spot exchange-traded funds on prices, questioning a common assumption that they are the main driver of BTC’s price.

  • Bitcoin

    30/09/2025 Data Debrief

    Why IBIT Options Traders Paid a Premium for Protection

    Today we’re looking at how risk is measured in crypto, by comparing both traditional and native markets. With the advent of multiple spot crypto exchange-traded funds there’s also a plethora of new derivative offerings. How traders price risk in these markets doesn’t always align. We’ll explore this today by looking at options on Deribit and Cboe.

  • Indices

    22/09/2025 Data Debrief

    Not Just Bitcoin: Baskets Show The Wider Market Story

    As we approach the end of the third quarter, we’re casting an eye over the broader market and which individual assets are driving returns. Despite BTC languishing over the summer, as ETH and XRP outperformed it, BTC has still dominated the narrative. However, we found that it’s not just the original cryptocurrency that’s driving returns in the market right now.

  • ETF

    15/09/2025 Data Debrief

    Competition for Crypto Options Heats Up

    This week we’re diving into all things crypto derivatives, with a particular focus on options markets. Crypto derivatives markets have been dominated by native players over the past decade, but now competition is growing. We explore this growing competition and how options on traditional venues might offer broader growth opportunities for altcoins.