Skip to content

SYSTEM ONLINE

LIVE TAPE
BTC$84,409.00▲ 0.2%·
ETH$2,686.05▼ 0.2%·
USDT$0.999777▼ 0.0%·
BNB$778.05▲ 0.8%·
XRP$1.52▼ 0.4%·
USDC$0.999841▼ 0.0%·
SOL$121.78▲ 0.7%·
TRX$0.33329▼ 0.2%·
ZEC$1,578.25▼ 3.9%·
FIGR_HELOC$1.06▼ 0.4%·
HYPE$91.40▼ 1.0%·
DOGE$0.096699▲ 0.4%·
LINK$13.97▼ 0.9%·
XMR$550.39▼ 1.4%·
WBT$84.18▲ 0.1%·
USDS$0.999682▼ 0.0%·
ADA$0.254687▲ 0.9%·
RAIN$0.012697▼ 1.4%·
BTC$84,409.00▲ 0.2%·
ETH$2,686.05▼ 0.2%·
USDT$0.999777▼ 0.0%·
BNB$778.05▲ 0.8%·
XRP$1.52▼ 0.4%·
USDC$0.999841▼ 0.0%·
SOL$121.78▲ 0.7%·
TRX$0.33329▼ 0.2%·
ZEC$1,578.25▼ 3.9%·
FIGR_HELOC$1.06▼ 0.4%·
HYPE$91.40▼ 1.0%·
DOGE$0.096699▲ 0.4%·
LINK$13.97▼ 0.9%·
XMR$550.39▼ 1.4%·
WBT$84.18▲ 0.1%·
USDS$0.999682▼ 0.0%·
ADA$0.254687▲ 0.9%·
RAIN$0.012697▼ 1.4%·

DEX

Curve Finance

2020 · Switzerlandcurve.finance ↗CRV market data →

Also known as Curve, Curve DAO, CRV, crvUSD, scrvUSD, LlamaLend, curve.fi, veCRV

curve finance

Curve Finance is a decentralised exchange built for swapping assets that should trade near the same price, such as USDC and USDT or ETH and stETH. It also issues the crvUSD stablecoin and runs LlamaLend lending markets. Michael Egorov designed it and launched it in early 2020; CRV holders who lock their tokens as veCRV govern it.

Our read

Curve remains the specialist venue for pegged pairs, and its vote-locked governance has run without a reset since August 2020. It suits stablecoin traders and LPs who understand pool parameters. The thing to watch is what surrounds the swap pools: permissionless LlamaLend markets on volatile collateral took bad debt in the October 2025 crash, and the 2023 compiler bug showed that Curve's risk includes the tools used to build it. Treat the swap pools and the lending markets as separate risk decisions.

01

Key facts

Total value locked
About $1.41 billion (Curve DEX about $1.31B)
Sep 2026 · DefiLlama ↗
Trading volume
About $3.3 billion in the last 30 days; about $352 billion all-time
Sep 2026 · DefiLlama ↗
2025 in numbers
$126B traded (up from $119B in 2024); 2,209 new pools; share of Ethereum DEX fees rose from 1.6% to 44%
Jan 2026 · Curve News ↗
Curve DAO launch
CRV and DAO contracts deployed by an anonymous community member (0xc4ad) using Curve's code
Aug 2020 · Curve News ↗
crvUSD minted by borrowers
$72.2 million, backed by $146.4 million of collateral; average mint rate 1.55%
Aug 2026 · Curve News ↗
02

What Curve Finance is and how its pools work

Curve started from Michael Egorov's StableSwap whitepaper in late 2019 and launched in early 2020 (Curve News). A normal AMM prices every pair on a curve that spreads liquidity across all possible prices. StableSwap packs most of it around a 1:1 ratio, so a large USDC-to-USDT swap moves the price very little, as long as the two assets stay near peg.

Pool typeBuilt forExamples
StableSwapAssets meant to trade at parityUSDC/USDT, ETH/stETH, WBTC/cbBTC
Cryptoswap (tricrypto)Volatile assets, with liquidity that re-centres on its ownThree-asset pools such as USDT/WBTC/ETH
FXSwapVolatile and FX-style pairs with passive liquidityYieldBasis BTC and ETH pools against crvUSD; CHF, GBP, BRZ and IDR pilots
LlamaLend marketsBorrowing crvUSD against collateralwstETH, WBTC, sreUSD

The trade-off is how a pool behaves when an asset loses its peg. A StableSwap pool keeps swapping at close to 1:1 until its balance becomes lopsided. LPs in a depegging pool end up holding mostly the failing asset. That is useful to know before providing liquidity for a small stablecoin because of its rewards. Curve's own score card is here.

03

crvUSD, LlamaLend and soft liquidations

crvUSD is Curve's dollar stablecoin, minted by borrowers against collateral. Its liquidation engine, LLAMMA, is different from Aave's or Compound's. As collateral falls into a band, it is gradually converted to crvUSD, and converted back if the price recovers. A borrower loses some value on the way down instead of taking a single liquidation hit, and can still be fully liquidated if the price keeps falling.

PegKeepers hold the price near $1. When crvUSD is scarce in its stable pools, they add supply. When it is plentiful, they withdraw it. In August 2026 a burst of demand, much of it linked to YieldBasis, pushed PegKeeper debt from $33.75M to $108.2M in six days. The mint rate fell to 1.55%, and borrower-minted crvUSD nearly doubled to $72.2M (Curve News). Hourly prices stayed within about 6 basis points of $1 that month.

LlamaLend markets are separate lending pools where anyone can lend crvUSD against one collateral asset. V2, live on Ethereum in 2026, adds yield-bearing collateral such as sreUSD and svZCHF. These markets are permissionless, and that has a cost: after the 10 October 2025 crash, several LlamaLend markets on volatile collateral took bad debt. The CRV-long market left lenders with impaired withdrawals for months (Curve News).

04

Curve DAO, veCRV and who controls Curve

Curve's governance was switched on in an unusual way. On 13 August 2020 an anonymous user, 0xc4ad, deployed the CRV and DAO contracts from code Curve had published for review. Curve verified the deployment and the community adopted it as the real launch. The model those contracts introduced, vote-escrow, is now copied across DeFi. You lock CRV to get veCRV, which carries voting power and a share of protocol fees, and the longer the lock, the more veCRV you get.

veCRV votes also decide which pools receive CRV emissions. That set off the "Curve Wars", where protocols such as Convex accumulated veCRV or paid its holders to direct rewards to their own pools. Over five years the DAO handled 1,276 proposals (Curve News).

  • Core development: funded by the DAO through grants to Swiss Stake AG, which reports quarterly.
  • Risk: LlamaRisk has provided risk oversight; in August 2026 the DAO selected yRisk as its risk provider, with funding executed on 2 September.
  • Treasury: since June 2025, 10% of protocol revenue goes to a DAO-controlled reserve. Before that, almost all fees went to veCRV holders and LPs.
  • Emergency DAO: a multisig that can cut, but never raise, crvUSD debt ceilings and pause specific components. Its powers were widened in November 2025.
05

Is Curve safe? Exploits, hijacks and bad debt on record

Curve's core swap maths has held up well. Its losses came from the layers around it: the compiler, the website domain and the newer lending markets.

DateWhat happenedSize
9 Aug 2022curve.fi DNS hijacked; users sent to a fake copy of the siteAbout $575K
30 Jul 2023Vyper compiler bug (broken reentrancy lock in versions 0.2.15, 0.2.16 and 0.3.0, in pools holding native ETH) drained pETH, alETH, msETH and CRV/ETH poolsAbout $69M across protocols; Curve's own CRV/ETH pool lost $24.2M
12 May 2025curve.fi hijacked again at the registrar; decoy site asked for signatures. Contracts untouchedNo loss figure published
10 Oct 2025Crash leaves bad debt in LlamaLend markets on volatile collateral, including CRV-longNot published as one figure
2 Mar 2026Donation attack on a LlamaLend marketAbout $240K

The 2023 incident is the lesson that stuck. Curve's contracts were correct as written, but the Vyper compiler versions used for some pools produced a reentrancy lock that did not work. Whitehats, including the bot 0xc0ffeebabe, saved about $17M while the attack was still running (Rekt). After the second DNS hijack, Curve moved its front end to curve.finance and has encouraged users to reach it through ENS rather than a registrar domain (Curve News).

06

Curve Finance news, 2025–2026

DateEvent
May 2025curve.fi hijacked; official front end moves to curve.finance
Jun 2025DAO creates a treasury funded by 10% of revenue
Aug 2025CRV emission rate cut on its programmed schedule
Oct 2025Crash leaves bad debt in some LlamaLend markets
Nov 2025Emergency DAO powers widened; Curve launches on Monad
2026LlamaLend V2 goes live on Ethereum; FXSwap pools for currency pairs
May 2026Market-based recovery pool for CRV-long lenders
Aug 2026yRisk selected as DAO risk provider; crvUSD mint rate falls to 1.55%

CRV token data is on our market page.

07

Incident log

5 entries · $69.8M lost in total · repaid, confirmed: 0 of 4 where user funds were at stake

  1. Exploit$240K

    Donation attack on a LlamaLend market

    A LlamaLend market lost about $240K to a donation attack that distorted its share accounting.

    Repayment unknownRecorded by DefiLlama; we found no Curve post describing reimbursement.

    DefiLlama ↗

  2. Insolvency

    LlamaLend markets take bad debt in the October crash

    Sharp price moves left some permissionless LlamaLend markets on volatile collateral with bad debt. Lenders in the CRV-long market faced impaired withdrawals for months.

    Not repaidNo repayment. In May 2026 Curve set up a voluntary market where lenders can sell their vault claims for crvUSD at a discount or hold them in case CRV recovers.

    Curve News ↗

  3. Hack

    curve.fi domain hijacked at the registrar

    Attackers changed DNS settings at the registrar and redirected curve.fi to a static decoy that prompted wallet signatures. Curve said no contracts or data were compromised and moved the front end to curve.finance.

    No funds at stakeCurve reported no protocol losses; no user loss figure was published.

    Curve News ↗

  4. Exploit$69.0M

    Vyper compiler bug drains several Curve pools

    A faulty reentrancy guard in Vyper 0.2.15, 0.2.16 and 0.3.0, in pools containing native ETH, let attackers drain pools including JPEG'd pETH/ETH ($11.5M), Alchemix alETH/ETH ($20.5M), Metronome msETH/ETH ($1.6M) and Curve's CRV/ETH ($24.2M). About $69M in total was taken.

    Partly repaidWhitehats front-ran part of the attack and about $17M was saved while it ran (Rekt). Attackers later returned more to several affected protocols, but we have not confirmed the final recovered total from a primary source.

    Rekt ↗

  5. Hack$575K

    curve.fi DNS hijack

    Attackers took over the curve.fi DNS records and served a fake copy of the site. Users who transacted through it lost about $575K.

    Repayment unknownDefiLlama records funds as returned, but we did not find a primary account of how much reached users.

    DefiLlama ↗

08

In our ratings

This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.

09

Compare Curve Finance with

Frequently asked questions

What is Curve Finance's official website?+

curve.finance. The old curve.fi domain was hijacked twice, in 2022 and May 2025, so bookmarks pointing to curve.fi should be replaced.

How do I stake CRV on Curve?+

You lock CRV to receive veCRV, which gives voting power, a share of fees and boosted LP rewards. Locked CRV cannot be withdrawn until the lock ends, so pick the lock length with that in mind.

Is crvUSD the same as the CRV token?+

No. crvUSD is a stablecoin minted against collateral and aimed at $1. CRV is the governance token, whose price moves freely.

Who founded Curve?+

Michael Egorov, who wrote the StableSwap whitepaper in 2019. He is also behind YieldBasis, a separate DAO whose pools route through crvUSD.

Was Curve hacked?+

Curve's own pools were drained once, by the July 2023 Vyper compiler bug, and its website domain was hijacked in 2022 and 2025. The core StableSwap logic itself has not been exploited.

11

What changed

  1. Profile published.

Compiled by

Olivia Bennett

By Olivia Bennett

Blockchain Security Researcher · September 27, 2026

We have no commercial relationship with Curve Finance and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.