
DEX
Curve Finance
2020 · Switzerlandcurve.finance ↗CRV market data →
Also known as Curve, Curve DAO, CRV, crvUSD, scrvUSD, LlamaLend, curve.fi, veCRV
curve finance
Curve Finance is a decentralised exchange built for swapping assets that should trade near the same price, such as USDC and USDT or ETH and stETH. It also issues the crvUSD stablecoin and runs LlamaLend lending markets. Michael Egorov designed it and launched it in early 2020; CRV holders who lock their tokens as veCRV govern it.
Our read
Curve remains the specialist venue for pegged pairs, and its vote-locked governance has run without a reset since August 2020. It suits stablecoin traders and LPs who understand pool parameters. The thing to watch is what surrounds the swap pools: permissionless LlamaLend markets on volatile collateral took bad debt in the October 2025 crash, and the 2023 compiler bug showed that Curve's risk includes the tools used to build it. Treat the swap pools and the lending markets as separate risk decisions.
Key facts
- Trading volume
- About $3.3 billion in the last 30 days; about $352 billion all-time
- Sep 2026 · DefiLlama ↗
- 2025 in numbers
- $126B traded (up from $119B in 2024); 2,209 new pools; share of Ethereum DEX fees rose from 1.6% to 44%
- Jan 2026 · Curve News ↗
- Curve DAO launch
- CRV and DAO contracts deployed by an anonymous community member (0xc4ad) using Curve's code
- Aug 2020 · Curve News ↗
- crvUSD minted by borrowers
- $72.2 million, backed by $146.4 million of collateral; average mint rate 1.55%
- Aug 2026 · Curve News ↗
What Curve Finance is and how its pools work
Curve started from Michael Egorov's StableSwap whitepaper in late 2019 and launched in early 2020 (Curve News). A normal AMM prices every pair on a curve that spreads liquidity across all possible prices. StableSwap packs most of it around a 1:1 ratio, so a large USDC-to-USDT swap moves the price very little, as long as the two assets stay near peg.
| Pool type | Built for | Examples |
|---|---|---|
| StableSwap | Assets meant to trade at parity | USDC/USDT, ETH/stETH, WBTC/cbBTC |
| Cryptoswap (tricrypto) | Volatile assets, with liquidity that re-centres on its own | Three-asset pools such as USDT/WBTC/ETH |
| FXSwap | Volatile and FX-style pairs with passive liquidity | YieldBasis BTC and ETH pools against crvUSD; CHF, GBP, BRZ and IDR pilots |
| LlamaLend markets | Borrowing crvUSD against collateral | wstETH, WBTC, sreUSD |
The trade-off is how a pool behaves when an asset loses its peg. A StableSwap pool keeps swapping at close to 1:1 until its balance becomes lopsided. LPs in a depegging pool end up holding mostly the failing asset. That is useful to know before providing liquidity for a small stablecoin because of its rewards. Curve's own score card is here.
crvUSD, LlamaLend and soft liquidations
crvUSD is Curve's dollar stablecoin, minted by borrowers against collateral. Its liquidation engine, LLAMMA, is different from Aave's or Compound's. As collateral falls into a band, it is gradually converted to crvUSD, and converted back if the price recovers. A borrower loses some value on the way down instead of taking a single liquidation hit, and can still be fully liquidated if the price keeps falling.
PegKeepers hold the price near $1. When crvUSD is scarce in its stable pools, they add supply. When it is plentiful, they withdraw it. In August 2026 a burst of demand, much of it linked to YieldBasis, pushed PegKeeper debt from $33.75M to $108.2M in six days. The mint rate fell to 1.55%, and borrower-minted crvUSD nearly doubled to $72.2M (Curve News). Hourly prices stayed within about 6 basis points of $1 that month.
LlamaLend markets are separate lending pools where anyone can lend crvUSD against one collateral asset. V2, live on Ethereum in 2026, adds yield-bearing collateral such as sreUSD and svZCHF. These markets are permissionless, and that has a cost: after the 10 October 2025 crash, several LlamaLend markets on volatile collateral took bad debt. The CRV-long market left lenders with impaired withdrawals for months (Curve News).
Curve DAO, veCRV and who controls Curve
Curve's governance was switched on in an unusual way. On 13 August 2020 an anonymous user, 0xc4ad, deployed the CRV and DAO contracts from code Curve had published for review. Curve verified the deployment and the community adopted it as the real launch. The model those contracts introduced, vote-escrow, is now copied across DeFi. You lock CRV to get veCRV, which carries voting power and a share of protocol fees, and the longer the lock, the more veCRV you get.
veCRV votes also decide which pools receive CRV emissions. That set off the "Curve Wars", where protocols such as Convex accumulated veCRV or paid its holders to direct rewards to their own pools. Over five years the DAO handled 1,276 proposals (Curve News).
- Core development: funded by the DAO through grants to Swiss Stake AG, which reports quarterly.
- Risk: LlamaRisk has provided risk oversight; in August 2026 the DAO selected yRisk as its risk provider, with funding executed on 2 September.
- Treasury: since June 2025, 10% of protocol revenue goes to a DAO-controlled reserve. Before that, almost all fees went to veCRV holders and LPs.
- Emergency DAO: a multisig that can cut, but never raise, crvUSD debt ceilings and pause specific components. Its powers were widened in November 2025.
Is Curve safe? Exploits, hijacks and bad debt on record
Curve's core swap maths has held up well. Its losses came from the layers around it: the compiler, the website domain and the newer lending markets.
| Date | What happened | Size |
|---|---|---|
| 9 Aug 2022 | curve.fi DNS hijacked; users sent to a fake copy of the site | About $575K |
| 30 Jul 2023 | Vyper compiler bug (broken reentrancy lock in versions 0.2.15, 0.2.16 and 0.3.0, in pools holding native ETH) drained pETH, alETH, msETH and CRV/ETH pools | About $69M across protocols; Curve's own CRV/ETH pool lost $24.2M |
| 12 May 2025 | curve.fi hijacked again at the registrar; decoy site asked for signatures. Contracts untouched | No loss figure published |
| 10 Oct 2025 | Crash leaves bad debt in LlamaLend markets on volatile collateral, including CRV-long | Not published as one figure |
| 2 Mar 2026 | Donation attack on a LlamaLend market | About $240K |
The 2023 incident is the lesson that stuck. Curve's contracts were correct as written, but the Vyper compiler versions used for some pools produced a reentrancy lock that did not work. Whitehats, including the bot 0xc0ffeebabe, saved about $17M while the attack was still running (Rekt). After the second DNS hijack, Curve moved its front end to curve.finance and has encouraged users to reach it through ENS rather than a registrar domain (Curve News).
Curve Finance news, 2025–2026
| Date | Event |
|---|---|
| May 2025 | curve.fi hijacked; official front end moves to curve.finance |
| Jun 2025 | DAO creates a treasury funded by 10% of revenue |
| Aug 2025 | CRV emission rate cut on its programmed schedule |
| Oct 2025 | Crash leaves bad debt in some LlamaLend markets |
| Nov 2025 | Emergency DAO powers widened; Curve launches on Monad |
| 2026 | LlamaLend V2 goes live on Ethereum; FXSwap pools for currency pairs |
| May 2026 | Market-based recovery pool for CRV-long lenders |
| Aug 2026 | yRisk selected as DAO risk provider; crvUSD mint rate falls to 1.55% |
CRV token data is on our market page.
Incident log
5 entries · $69.8M lost in total · repaid, confirmed: 0 of 4 where user funds were at stake
Exploit$240K
Donation attack on a LlamaLend market
A LlamaLend market lost about $240K to a donation attack that distorted its share accounting.
Repayment unknownRecorded by DefiLlama; we found no Curve post describing reimbursement.Insolvency
LlamaLend markets take bad debt in the October crash
Sharp price moves left some permissionless LlamaLend markets on volatile collateral with bad debt. Lenders in the CRV-long market faced impaired withdrawals for months.
Not repaidNo repayment. In May 2026 Curve set up a voluntary market where lenders can sell their vault claims for crvUSD at a discount or hold them in case CRV recovers.Hack
curve.fi domain hijacked at the registrar
Attackers changed DNS settings at the registrar and redirected curve.fi to a static decoy that prompted wallet signatures. Curve said no contracts or data were compromised and moved the front end to curve.finance.
No funds at stakeCurve reported no protocol losses; no user loss figure was published.Exploit$69.0M
Vyper compiler bug drains several Curve pools
A faulty reentrancy guard in Vyper 0.2.15, 0.2.16 and 0.3.0, in pools containing native ETH, let attackers drain pools including JPEG'd pETH/ETH ($11.5M), Alchemix alETH/ETH ($20.5M), Metronome msETH/ETH ($1.6M) and Curve's CRV/ETH ($24.2M). About $69M in total was taken.
Partly repaidWhitehats front-ran part of the attack and about $17M was saved while it ran (Rekt). Attackers later returned more to several affected protocols, but we have not confirmed the final recovered total from a primary source.Hack$575K
curve.fi DNS hijack
Attackers took over the curve.fi DNS records and served a fake copy of the site. Users who transacted through it lost about $575K.
Repayment unknownDefiLlama records funds as returned, but we did not find a primary account of how much reached users.
In our ratings
This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.
Compare Curve Finance with
UniswapDEX · 2018 · United StatesUniswap is the automated market maker behind about $3.9 trillion of all-time DEX volume. Since December 2025 part of its swap fees buys and burns UNI.
BalancerDEXBalancer is the weighted-pool DEX drained of about $128 million in November 2025. Balancer Labs shut in 2026; a DAO vote on winding down closes 29 Sept.
PancakeSwapDEX · 2020PancakeSwap is the largest DEX on BNB Chain, trading about $28.6 billion a month. Up to 23% of each v3 swap fee buys and burns its CAKE token.
JupiterDEX · PanamaJupiter is Solana's main swap aggregator, routing about $15 billion a month across Solana DEXs. Half its on-chain revenue buys JUP for a trust.
Frequently asked questions
What is Curve Finance's official website?+
curve.finance. The old curve.fi domain was hijacked twice, in 2022 and May 2025, so bookmarks pointing to curve.fi should be replaced.
How do I stake CRV on Curve?+
You lock CRV to receive veCRV, which gives voting power, a share of fees and boosted LP rewards. Locked CRV cannot be withdrawn until the lock ends, so pick the lock length with that in mind.
Is crvUSD the same as the CRV token?+
No. crvUSD is a stablecoin minted against collateral and aimed at $1. CRV is the governance token, whose price moves freely.
Who founded Curve?+
Michael Egorov, who wrote the StableSwap whitepaper in 2019. He is also behind YieldBasis, a separate DAO whose pools route through crvUSD.
Was Curve hacked?+
Curve's own pools were drained once, by the July 2023 Vyper compiler bug, and its website domain was hijacked in 2022 and 2025. The core StableSwap logic itself has not been exploited.
What changed
- Profile published.
Compiled by
Blockchain Security Researcher · September 27, 2026
We have no commercial relationship with Curve Finance and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.