Data leak

Tweet by Curve Finance

2025-05-12 [vendor] Curve Finance website and Twitter account
Primary Source ↗

Incident Details

The website and Twitter accounts belonging to the Curve Finance defi projects were compromised in quick succession. On May 5, an attacker compromised the Twitter account belonging to the project, posting a scam in which they appeared to announce an airdrop.Then, on May 12, the project posted a warning that the website for the Curve frontend was “hijacked” in an apparent domain takeover.This is not the first such compromise for Curve, which suffered a frontend compromise in August 2022 that resulted in $620,000 in losses (later recovered with the help of some exchanges).

Technical Details

Initial Attack Vector
DNS hijacking / domain takeover (front-end compromise)
Vendor / Product
Curve Finance website and Twitter account

Timeline

  1. 2025-05-12 Breach occurred
  2. 2025-05-12 Publicly disclosed