Bessie Liu

Macauley Peterson

Exchange liquidity protocol Curve has launched its first native stablecoin — crvUSD.



The news coincided with a trader borrowing most of the available Curve DAO token (CRV) on Aave, over $50 million worth. The spike in the price of CRV over the past 8 hours put that position very close to — and eventually over — its liquidation point.



The trader is presumed to be Avraham Eisenberg, <a href="https://blockworks.co/news/mango-dao-readies-42m-to-make-users-whole">previously linked to the controversial exploit</a> of Mango Markets on the Solana network, <a href="https://twitter.com/LlamaCollege/status/1594695900634284033">based on Discord discussions</a> related to the trade.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Mango &#39;very profitable trading strategist&#39; <a href="https://twitter.com/avi_eisen?ref_src=twsrc%5Etfw">@avi_eisen</a> has an $8m short on CRV.<a href="https://twitter.com/CurveFinance?ref_src=twsrc%5Etfw">@CurveFinance</a> founder <a href="https://twitter.com/newmichwill?ref_src=twsrc%5Etfw">@newmichwill</a> has $48m of CRV supplied on Aave with a liquidation price of .259 Yesterday they had an interesting discussion in the Convex discord. 🦙🏫 ↓ <a href="https://t.co/t28vN9l2PZ">pic.twitter.com/t28vN9l2PZ</a>&mdash; LlamaCollege (@LlamaCollege) <a href="https://twitter.com/LlamaCollege/status/1594695893638598657?ref_src=twsrc%5Etfw">November 21, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Eisenberg did not immediately return a request to comment via Twitter.



The trader, or trading group, had about $58 million in USDC supporting a $50 million loan of CRV as of 12:20 pm ET on Tuesday.



<figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/T01qGlFxSZpUAKbSfzoFRVSHEjE4qTrqvPTMVfc_bfqWUBYTnjd26wtWX0wSeMS0m-ZkHUcKhYBt8GV38-F-Nep2INNBdFXy7PrCZ7flnp3HgIOx0nifipwB_ScF90dcx8MxVjv1mbpGPzKVNNxaQpYzHz6j2a2JWHqajN_FT6N-tv8_LKCI0ZflaqgQMw" alt=""/><figcaption class="wp-element-caption">Trader&#8217;s position on Aave&#8217;s V3 Ethereum market as of 12:20 pm ET</figcaption></figure>



By 1:10 pm ET, all of that position was liquidated, leaving the Aave protocol with 2.64 million CRV — or about $1.7 million — in bad debt.



It’s not clear what the trade strategy was, but the Aave position was so large it could not be fully liquidated using the available collateral. That&#8217;s because the availability of spot CRV was limited enough that the value of <a href="https://blockworks.co/price/crv" target="_blank" rel="noreferrer noopener">CRV jumped</a> to a high of around $0.71 as the position was unwound, data collected by Blockworks shows.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The attack on <a href="https://twitter.com/AaveAave?ref_src=twsrc%5Etfw">@AaveAave</a> is over and the protocol is left with 2.64 million CRV in bad debt, currently valued at almost $2 million. Aave will now have to liquidate enough AAVE from from the safety module to buy back 2.64m CRV. <a href="https://twitter.com/avi_eisen?ref_src=twsrc%5Etfw">@avi_eisen</a> &#8211; the black hat financial engineer <a href="https://t.co/W4j75RymMb">pic.twitter.com/W4j75RymMb</a>&mdash; Matt Fiebach 🟪 (@MattFiebach) <a href="https://twitter.com/MattFiebach/status/1595118515203502084?ref_src=twsrc%5Etfw">November 22, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<h2>The Curve Finance stablecoin</h2>



Michael Egorov, Curve’s founder, previously <a href="https://blockworks.co/news/curve-stablecoin-is-in-the-works-despite-regulatory-scrutiny" target="_blank" rel="noreferrer noopener">said</a> the stablecoin will maintain its peg to the US dollar through overcollateralization.



Its <a href="https://github.com/curvefi/curve-stablecoin/blob/master/doc/curve-stablecoin.pdf" target="_blank" rel="noreferrer noopener">latest white paper</a> reveals that the stablecoin’s design will be executed through the Lending-Liquidating Automated Market Maker Algorithm (LLAMMA) which converts between collateral and the stablecoin. So, if the price of a collateral (ETH) dips, the automated market maker will convert deposits to a stablecoin (USD).



LLAMMA will automatically calculate bands to locate where the collateral sits, and if the price of the collateral changes, it will be converted to the stablecoin.&nbsp;



The crvUSD will maintain its peg to USD through a peg-keeping reserve that is formed by an asymmetric deposit (when the outcome of the deposit has more profit than loss or risk taken to achieve the profit) into a stableswap pool made up of the stabletoken and a redeemable reference coin or an LP token.



The timing of the launch <a href="https://twitter.com/0xMaki/status/1595122398155927552" target="_blank" rel="noreferrer noopener">is interesting</a> — it appears to have caused a sharp rise in the price of CRV, putting the collateral for the trader’s loan in danger.



<figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/fVehUH7bBg1hZMfw3ocrLz-tYE6-d2ZpmC3UKpCmZE-PYZeYrxoNR23Jr2tFd-P1fK38BIPaBTjK-qkUXMb38jlCDigAJlenVTC25v3NCXEEkZFfoewfcdGtFMGvpN_i_ZooCku51l4OFJsKMwX6xajSxibNqL-a82TjsV84yjEl8trlc6oR38A69LrcuQ" alt=""/></figure>



The owner of the wallet borrowing CRV <a href="https://etherscan.io/address/0xba529566855d9d0bf3de1cc988e5f529f92bd80c#tokentxns" target="_blank" rel="noreferrer noopener">transferred the tokens to OKX</a>, a Seychelles-based cryptocurrency exchange and derivatives exchange, but the subsequent use of those tokens is not known.



Eisenberg&#8217;s Twitter account <a href="https://twitter.com/avi_eisen/status/1595024418837000199" target="_blank" rel="noreferrer noopener">posted</a> that he was &#8220;taking the day off to spend time with family&#8221; but that appears to have been meant ironically, as his next tweet indicated he was very much monitoring the situation.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Couple more liquidations then up only&mdash; Avraham Eisenberg (@avi_eisen) <a href="https://twitter.com/avi_eisen/status/1595103248255717378?ref_src=twsrc%5Etfw">November 22, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Egorov maintains a large position on Aave using CRV as collateral, which some have speculated could have been the target of the trade — if the CRV was sold, creating a short position, which is unknown.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/search?q=%24CRV&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$CRV</a> drama TLDR: If Avi liquidated, AAVE has to buy 80m CRV onchain = price up If Mich liquidated, AAVE has to sell 180m CRV onchain = price to 0&mdash; Sotto ✨ (@sotto_eth) <a href="https://twitter.com/sotto_eth/status/1595007650408058880?ref_src=twsrc%5Etfw">November 22, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



However, it could also be the case that a more complex strategy involved purposefully allowing the CRV loan to be liquidated, which forced Aave liquidators to buy back CRV using the trader’s USDC collateral.



The price of Aave initially dropped as bad debt began to accrue in the protocol, although it recovered fully once liquidation was complete and trades at about $55 as of 1:40 pm ET — flat over 24 hrs, <a href="https://blockworks.co/price/aave" target="_blank" rel="noreferrer noopener">data compiled by Blockworks</a> shows.



Aave&#8217;s team <a href="https://twitter.com/The3D_/status/1595123156821630976" target="_blank" rel="noreferrer noopener">expects to easily cover</a> the short fall with its treasury holdings.



This story was updated on Nov. 22, 2022 at 1:00 pm, 1:20 pm, 1:35 pm, 1:45 pm and 1:55 pm ET.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Someone Paid 600% Interest on $50M To Borrow CRV, Then Watched It Get Liquidated

The price of stablecoin Tether (USDT) briefly fell to 97 cents on Thursday, according to <a href="https://cms.blockworks.co/prices/">data compiled by Blockworks</a> — and as low as $0.938 on the Kraken exchange — raising fears regarding the stability of its peg to the US dollar.



A downtrend in cryptoasset markets — this week spurred by <a href="https://cms.blockworks.co/news/sbf-commits-to-radical-transparency-as-ftx-seeks-investment-capital/">the solvency crisis of FTX</a> and Alameda Research — leads traders to seek safe haven in stablecoins.



The sudden price drop of Tether this morning led put traders on alert. However, during periods of heightened market volatility, temporary price wobbles are not uncommon.



<figure class="wp-block-embed is-type-wp-embed is-provider-flourish wp-block-embed-flourish"><div class="wp-block-embed__wrapper">
<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" src="https://flo.uri.sh/visualisation/11773537/embed#?secret=2EQkcRz0x6" data-secret="2EQkcRz0x6" frameborder="0" scrolling="no" height="575" width="700"></iframe>
</div></figure>



USDT is considered the backbone to the cryptoasset ecosystem, making up almost <a href="https://cms.blockworks.co/news/tether-dominance-nears-all-time-high-as-crypto-crashes/">9%</a> of the entire digital asset market capitalization. The coin is supposedly backed 1:1 by US dollars and highly liquid assets — which maintains its “peg” to the greenback — although <a href="https://cms.blockworks.co/news/us-judge-orders-tether-to-prove-what-backs-usdt/">Tether’s track record</a> when it comes to transparency has been criticized in the past.



“During periods of market volatility, the trading price for USDT that is quoted on exchanges may fluctuate,” the company <a href="https://tether.to/en/ftx-black-swans-and-tethers-continued-stability/">said</a> in a statement.&nbsp;



In fact, in May, after the implosion of the Terra ecosystem and its UST stablecoin, the price of USDT also dipped.&nbsp;



“This happens because there is more demand for liquidity than exists on that exchange&#8217;s order books and has nothing to do with Tether&#8217;s ability to hold its peg nor the value or makeup of its reserves,” the company said.&nbsp;



Adding that, “industry critics and skeptics alike have done themselves an injustice by remaining uninformed and jumping to conclusions.”



Tether’s price is also reflected in on-chain liquidity, chiefly via the <a href="https://curve.fi/#/ethereum/pools/3pool/swap" target="_blank" rel="noreferrer noopener">Curve 3Pool on Ethereum</a> — which holds a significant amount of liquidity on the three largest stablecoin assets, DAI, USDC and USDT — where changes to supply and demand can influence the price of Tether.



Early Thursday, Curve’s 3Pool became unbalanced, a sign that some industry participants began shorting Tether.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Curve 3pool getting quite unbalanced. Rather heavy on the USDT! <a href="https://t.co/kwtfvv2anJ">https://t.co/kwtfvv2anJ</a> <a href="https://t.co/J3CtcFgZ33">pic.twitter.com/J3CtcFgZ33</a>&mdash; simian_derivative (@simianderiv) <a href="https://twitter.com/simianderiv/status/1590686564602245121?ref_src=twsrc%5Etfw">November 10, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



A higher percentage of USDT in the pool reflects a drop in the relative value of USDT compared to USDC and DAI.



Generally, the ability for large market participants to redeem USDT for dollars makes such de-pegs short lived.



Indeed, chief technology officer of Tether, Paolo Ardoino, <a href="https://twitter.com/paoloardoino" target="_blank" rel="noreferrer noopener">tweeted</a> that the company had “processed ~700M redemptions in [the] last 24h. No issues. We keep going,” he said.



The company further confirmed that it had extended no credit towards FTX or Alameda Research — and that its tokens were 100% backed by reserves which exceed the liabilities.&nbsp;



As of writing, the proportion of USDT in the Curve pool has dropped back to 67%, with about $670 million in liquidity available.



“Trust is built over years, but can be lost in moments. It&#8217;s easy to wonder who else could fail if large and trusted players suddenly go under,” Tether said. “Tether will continue to dispel fears and speak to the concerns of the community.”



Since the dip earlier this morning, the price of Tether has rebounded to <a href="https://www.coingecko.com/en/coins/tether" target="_blank" rel="noreferrer noopener">$1.01</a>.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Tether Peg Hiccups Are Nothing New

Shalini Nagarajan

<div id="highlights-block_63298f8951bb3" class="highlights">
 <ul>
 <li>A bug in vanity address generator Profanity suspected as attack vector, security experts say</li>
 <li>Stablecoins, the vast majority of the funds, have been deposited to Curve Finance, likely to evade blacklisting</li>
 </ul>
 
</div>



Liquidity provider Wintermute, which provides liquidity across most CeFi and DeFi exchanges, has suffered a major setback in a second security-based incident this year.&nbsp;&nbsp;



CEO Evgeny Gaevoy disclosed in a <a href="https://twitter.com/EvgenyGaevoy/status/1572134271011225601" target="_blank" rel="noreferrer noopener">Twitter thread</a> on Tuesday that the platform encountered a $160 million breach in its decentralized finance (DeFi) operations. The firm’s CeFi operations and over-the-counter services weren’t affected, he said.



Gaevoy indicated Wintermute remains solvent, with $320 million in equity left after the hack. Users can expect the platform to face disruptions over the next few days until operations return to normal.&nbsp;



The CEO said the firm is &#8220;open to&#8221; treating the situation as a white hat, referring to hackers that just test vulnerabilities in a system, as compared to malicious hackers. It’s not known whether that is the hacker&#8217;s intent.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We are (still) open to treat this a s a white hat, so if you are the attacker – get in touch&mdash; wishful cynic (@EvgenyGaevoy) <a href="https://twitter.com/EvgenyGaevoy/status/1572134291382960130?ref_src=twsrc%5Etfw">September 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Wintermute is among the largest crypto liquidity providers dedicated to crypto market making for exchanges including Binance and Coinbase.



The hack is already having knock-on effects, such as the <a href="https://twitter.com/bebop_dex/status/1572157679216525319" target="_blank" rel="noreferrer noopener">pausing of trading</a> on Bebob, an upstart DeFi dex using Wintermute&#8217;s market making services.



Tuesday’s incident marks the second time the firm was involved with a hack this year. In June, a hacker stole 20 million Optimism tokens by exploiting a <a href="https://cms.blockworks.co/20m-tokens-lost-as-market-maker-wintermute-takes-blame/" target="_blank" rel="noreferrer noopener">failed transaction</a> with Wintermute.



<h3>Security experts point to a known bug&nbsp;as Wintermute hack vector</h3>



Mudit Gupta, chief security officer at Polygon, guessed <a href="https://twitter.com/Mudit__Gupta/status/1572150289943363589" target="_blank" rel="noreferrer noopener">in a tweet</a> that the hack was a result of a hot wallet compromise due to the <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">Profanity bug</a> uncovered by 1inch contributors last week. 1inch had warned that wallet addresses generated using the Profanity tool were at risk of compromise.



“If you used Profanity to get a vanity smart contract address, make sure to change the owners of that smart contract,” 1inch staff wrote in a Sept. 15 <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">blog post</a>.



The contributors noted that Profanity’s popularity didn’t mean it wasn’t without defect, and that its vulnerability enabled hackers to “secretly” steal tens of millions of dollars from users’ wallets.



<blockquote class="wp-block-quote">“It’s not a simple task, but at this point it looks like tens of millions of dollars in cryptocurrency could be stolen, if not hundreds of millions,” they said in the post.</blockquote>



The <a href="https://debank.com/profile/0xe74b28c2eae8679e3ccc3a94d5d0de83ccb84705" target="_blank" rel="noreferrer noopener">Ethereum address</a> associated with the Wintermute hack held nearly $13 million in wrapped bitcoin (WBTC) and $9.3 million in ETH, among other tokens including matic, DYDX and FTX tokens as of 6:15 am ET on Tuesday.



Most of the stolen funds — $114 million in USDC and USDT stablecoins — have been moved to Curve Finance flagship “3Crv” liquidity pool. That may make it harder for centralized stablecoin issuers Circle and Tether to freeze the tokens, as they are commingled within the $869 million pool.



A Tether spokesperson told Blockworks that the firm is ready to collaborate in any investigation that law enforcement will initiate to help in the recovery of such funds.



Gaevoy didn’t specify when the hack took place or how it happened. In a <a href="https://twitter.com/EvgenyGaevoy/status/1572329658636537857">later tweet</a>, he offered the hacker a 10% bounty on the funds if returned. Wintermute and Circle didn’t return Blockworks’ request for comment by press time.



This story was updated on Sept. 20 at 11:42 pm ET.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Wintermute Whacked by $160M Hack Exploiting Known Vulnerability

<div id="highlights-block_63185147d614a" class="highlights">
 <ul>
 <li>Matrixport is a British Virgin Islands registered cryptoasset financial services provider</li>
 <li>Three Arrows Capital owed $3.5 billion to 27 crypto companies at the time of its bankruptcy</li>
 </ul>
 
</div>



Cryptocurrency hedge fund <a href="https://cms.blockworks.co/tag/3ac/" target="_blank" rel="noreferrer noopener">Three Arrows Capital</a> (3AC) declared <a href="https://cms.blockworks.co/3ac-files-for-bankruptcy-as-co-founders-location-unknown/" target="_blank" rel="noreferrer noopener">bankruptcy</a> two months ago, so it was eyebrow-raising when on-chain analytics firms reported Tuesday it was still executing relatively hefty transactions. Those initial reports turn out to be wrong.



On-chain data showed a <a href="https://etherscan.io/address/0x23237b849d0e6f392573ee6ae9e3b1256f058143" target="_blank" rel="noreferrer noopener">wallet</a> identified by on-chain analytics firm Nansen as belonging to 3AC withdrew a total of $45 million from deposits previously staked on Curve Finance and Convex Finance.&nbsp;



More specifically, the wallet removed about 20,945 staked ether ($33.3 million) from Curve. From Convex, it retrieved 2,421 wrapped ether ($4 million), 202.7 wrapped bitcoin ($4 million) and 4 million USDT, according to data from security firm PeckShield.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw">#PeckShieldAlert</a> The address labeled as 3AC withdrew ~20,945 <a href="https://twitter.com/search?q=%24stETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$stETH</a> (~$33.3M) from Curve Finance and ~2,421 <a href="https://twitter.com/search?q=%24WETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$WETH</a> (~$4M), ~ 202.7 <a href="https://twitter.com/search?q=%24WBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$WBTC</a> (~$4M) and ~4M <a href="https://twitter.com/search?q=%24USDT&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$USDT</a> from Convex Finance. <a href="https://t.co/8R3J0IFtP1">https://t.co/8R3J0IFtP1</a> <a href="https://t.co/WSZI1iR05X">pic.twitter.com/WSZI1iR05X</a>&mdash; PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1567179464370712577?ref_src=twsrc%5Etfw">September 6, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The labeling of 3AC’s wallet by Nansen did not make it a certainty. In response to skepticism over the firm’s labelling in the past, Nansen CEO Alex Svanevik remarked in June, “we can (but rarely) make mistakes — no-one is perfect.”



Blockworks contacted Nansen to gauge the reliability of the labeling in this case and learned this was one of those times. According to a Nansen spokesperson:



<blockquote class="wp-block-quote">&#8220;This wallet was labelled Three Arrows Capital (3AC) due to it receiving large amounts of crypto from another known 3AC wallet. After investigating further, we’ve confirmed it was a 3AC counterparty managing this wallet: Matrixport. We’ve updated the label to reflect this.&#8221;</blockquote>



Matrixport is a financial services platform for cryptoassets that includes trading, borrowing and lending, and staking products.



The purpose behind Tuesday’s withdrawals isn’t clear, but <a href="https://www.matrixport.com/about" target="_blank" rel="noreferrer noopener">the company</a> did confirm the wallet is theirs.



<blockquote class="wp-block-quote">&#8220;The Matrixport wallet activity is part of our routine operations and not related to 3AC,&#8221; Ross Gan, head of public relations told Blockworks.</blockquote>



One reason behind the move may be that stETH holders will be unable to redeem their tokens for ether until <a href="https://twitter.com/lidofinance/status/1536756940419784704?lang=en" target="_blank" rel="noreferrer noopener">at least six months</a> after the Merge, which is slated for <a href="https://cms.blockworks.co/ethereum-merge-countdown-at-t-20-days/" target="_blank" rel="noreferrer noopener">Sept. 15</a>.



A Twitter speculator <a href="https://twitter.com/jadid/status/1567163416795844616" target="_blank" rel="noreferrer noopener">suggested</a> that the withdrawal move shows big wallet holders plan to liquidate their ether in the period of heightened focus on Ethereum around the Merge. Crypto markets are broadly down, but ether has shown strength relative to bitcoin, remaining in a daily uptrend since Aug. 29.



3AC owed 27 crypto companies <a href="https://cms.blockworks.co/3ac-co-founders-used-funds-assets-for-50m-yacht-bungalows/" target="_blank" rel="noreferrer noopener">$3.5 billion</a> at the time of its bankruptcy, with its biggest creditor being crypto brokerage Genesis. Founders Su Zhu and Kyle Davies have mostly laid low in the months following their fund’s collapse, allegedly refusing to cooperate with the <a href="https://cms.blockworks.co/three-arrows-capital-ordered-into-liquidation-by-bvi-court-report/" target="_blank" rel="noreferrer noopener">court-appointed liquidator</a> Teneo that’s overseeing its liquidation.&nbsp;



Blockworks had reached out to restructuring firm Teneo, who declined to comment on the alleged withdrawals, saying that the restructuring firm is focused on advancing the liquidation process “in order to maximize asset recoveries on behalf of all creditors.”



“During this time, it would be inappropriate to comment on speculation surrounding transactions that may or may not relate to Three Arrows or the investigations that are underway,” a spokesperson told Blockworks.



3AC didn’t return a request for comment by press time.



This story was updated on Sept. 7 at 9:15 am ET with new information about the funds&#8217; origin, and on Sept. 8 at 3:12 am ET with comment from Matrixport.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Withdrawal of $45M from Curve Finance, Convex, Was Not From 3AC, Nansen Says

<div id="highlights-block_62f62ca522927" class="highlights">
 <ul>
 <li>Compared to protocol exploits, the losses suffered as a result of the DNS hijack are relatively small</li>
 <li>Both operational security and technical security of DeFi dapps is expected to improve</li>
 </ul>
 
</div>



Binance managed to freeze or recover a majority of the funds that hackers stole from DeFi protocol Curve Finance this week, the exchange&#8217;s CEO <a href="https://cms.blockworks.co/tag/changpeng-zhao/" target="_blank" rel="noreferrer noopener">Changpeng Zhao</a> said on Friday.



Zhao said in a tweet that the exchange is working with law enforcement authorities to return funds to users. Curve <a href="https://twitter.com/cz_binance/status/1557956979275988992" target="_blank" rel="noreferrer noopener">retweeted</a> Zhao’s post, an apparent confirmation of the development.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Binance froze/recovered $450k of the Curve stolen funds, representing 83%+ of the hack. We are working with LE to return the funds to the users. The hacker kept on sending the funds to Binance in different ways, thinking we can&#39;t catch it. 😂<a href="https://twitter.com/hashtag/SAFU?src=hash&amp;ref_src=twsrc%5Etfw">#SAFU</a> <a href="https://t.co/Ekea9moeAw">https://t.co/Ekea9moeAw</a>&mdash; CZ 🔶 Binance (@cz_binance) <a href="https://twitter.com/cz_binance/status/1557956979275988992?ref_src=twsrc%5Etfw">August 12, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Curve — the fourth largest DeFi (decentralized finance) protocol with about $6 billion in total value locked (TVL) — was <a href="https://cms.blockworks.co/website-of-decentralized-crypto-exchange-curve-compromised/" target="_blank" rel="noreferrer noopener">struck by a security incident</a> on Aug. 9, leading it to warn users against using its website. About $570,000 worth of tokens were believed to be stolen in the hack.



Unlike protocol exploits, the culprits took advantage of shortcomings in the security of online service providers — in this case, Curve’s domain name system (DNS). A DNS maps readable website names to IP addresses.



Marcus Sotiriou, analyst at GlobalBlock, said the hackers modified the IP address translated by the DNS for <a href="https://curve.fi/" target="_blank" rel="noreferrer noopener">the curve.fi website</a>. They provided the IP address of their own server and created an identical web application, he said in a note, allowing them to create new smart contracts to steal money. Users were approving transactions that were actually stealing their funds.



In the past two years, such attacks have become prevalent in the crypto industry as thieves search for ways to part crypto users from their funds.



Last month, infrastructure provider <a href="https://cms.blockworks.co/hacker-posed-as-ankr-employee-to-phish-polygon-and-fantom-users/" target="_blank" rel="noreferrer noopener">Ankr was hit with</a> a social engineering-instigated DNS attack.



“This is an example of how important it is for users within DeFi to be fully educated on the protocols they use,” Sotiriou said.



<blockquote class="wp-block-quote">“People could have protected themselves if they checked all the smart contracts they interact with,” he said.</blockquote>



But this is beyond the technical know-how of a vast majority of DeFi users, according to <a href="https://www.linkedin.com/in/teddy-woodward-829b204a/" target="_blank" rel="noreferrer noopener">Teddy Woodward</a>, co-founder of Notional Finance.



“The average retail user is not going to review the smart contracts they interact with [but] I think it is reasonable for larger or more professional users like businesses and funds to make an effort there, and many do,” Woodward told Blockworks, adding that over time, the safety of DeFi protocols has been consistently trending upward.



Each exploit hardens dapps and makes them safer for the average user.



“I think about it like plane travel,” Woodward said. “That used to be extremely dangerous, now it&#8217;s safer than driving a car.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Binance Recovers Majority Funds Stolen in Curve Finance Hack

Casey Wagner

<div id="highlights-block_62d9c75ee816f" class="highlights">
 <ul>
 <li>Curve CEO Michael Egorov said the company is looking to launch its own stablecoin</li>
 <li>Overcollateralized stablecoins have reserves of cryptocurrency tokens or other assets that exceed the number of stablecoins issued, providing, in theory, a buffer against price fluctuations</li>
 </ul>
 
</div>



Exchange liquidity pool Curve is looking to launch its first native stablecoin, joining a number of institutional market players vying to seize market share following the recent, sudden and spectacular blow-up of <a href="https://cms.blockworks.co/tag/Terra/">Terra</a>’s UST stablecoin.&nbsp;



The firm’s chief executive, Michael Egorov, in a <a href="https://www.zipeventapp.com/e/REDEFINE-TOMORROW-2022" target="_blank" rel="noreferrer noopener">virtual appearance Thursday</a> said the stablecoin is slated to be overcollateralized. <a href="https://cms.blockworks.co/tag/UST/" target="_blank" rel="noreferrer noopener">TerraUSD</a> — the implosion of which sent digital-asset markets spiraling to the extent many a trader has yet to fully recover — has come under fire, in part, for not maintaining sufficient collateral to hold its one-to-one peg to the US dollar. 



“That’s all I can say for now,” Egorov said, without specifying a launch date.



Overcollateralized stablecoins have reserves of cryptocurrency tokens or other assets that exceed the number of stablecoins issued, providing, in theory, a buffer against price fluctuations. It’s a similar setup to bitcoin-denominated loans, which most always require the debtor to pony up far more of the cryptocurrency than, in theory, is needed to back the line of credit in question.



Egorov did not elaborate on specific assets set to serve as reserves for the new product. Stablecoins are typically backed by the dollar, the euro or other liquid and mainstream fiat currencies. Other stablecoins, including <a href="https://cms.blockworks.co/tag/tether/">Tether</a>, have faced scrutiny over a lack of transparency and the prospect of investing customer stablecoin funds in relatively illiquid assets.&nbsp;



The planned launch comes as regulators worldwide — perhaps most notably, US Treasury Secretary <a href="https://cms.blockworks.co/tag/janet-yellen/" target="_blank" rel="noreferrer noopener">Janet Yellen</a>, who has <a href="https://cms.blockworks.co/yellen-ust-collapse-could-have-been-avoided-with-rules-for-stablecoin-issuers/" target="_blank" rel="noreferrer noopener">called for stablecoins to be strictly overseen</a> in a manner akin to FDIC-insured banks — amp up processes for stablecoin rulemaking in the aftermath of TerraUSD’s collapse. 



“UST was collateralized by LUNA, which ultimately depends on the success of UST,” Egorov said. “That exposed UST to the death spiral.”&nbsp;



The International Organization of Securities Commissions (IOSCO) and the Bank for International Settlements’ Committee on Payments and Market Infrastructures (CPMI) earlier this month issued their, for now, <a href="https://cms.blockworks.co/stablecoin-regulation-ramps-up-across-the-globe-with-new-bis-guidance/" target="_blank" rel="noreferrer noopener">final guidance</a> on best stablecoin practices. 



“The recent market disruptions, while costly for many, were not systemic events,” Jon Cunliffe, chair of the CPMI and deputy governor for financial stability at the Bank of England, said in a <a href="https://www.bis.org/press/p220713.htm" target="_blank" rel="noreferrer noopener">statement</a>, presumably referring to UST’s depeg in May.



If a stablecoin serves as a mechanism for transferring monetary value — and is deemed “systemically important” to financial markets — it must, in the BIS’ view, abide by a specific set of international standards put in place in the wake of the global financial crisis of 2008.



Regulators in the US say they’re especially concerned when it comes to transparency and guidelines around stablecoin reserves. ​​“If you just look at the events in April and May, basically the question everybody asked was ‘What are these stablecoins? Are they really stable? What is backing it?,’” Wolfgang Bardorf, senior vice president and group treasurer of Checkout.com, said during a recent Blockworks <a href="https://cms.blockworks.co/webinars/will-stablecoins-transform-the-business-of-banking/?source=twitter" target="_blank" rel="noreferrer noopener">webinar</a>.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">