DeFi Protocol Convergence Got Hacked, CVG Token Plunges 99% on Curve

Decentralized finance protocol Convergence, a Curve-based yield-enhancing protocol, a was exploited Thursday, sending its token's price to near-zero.

The attacker created (minted) 58 million of the protocol's CVG token using a vulnerability in the protocol's codebase, and swapped the tokens for 60 wrapped ether (wETH) and 15,900 crvFRAX stablecoin using liquidity pools on Curve, web3 security auditing firm QuillAudits said.

Blockchain data on Etherscan shows that the attacker's address converted the funds to ether (ETH) and sent the tokens to Tornado Cash.

The attack caused about $210,000 loss, QuillAudits added.

CVG holders, however, suffered additional damage as the token's $17 million fully diluted value (FDV) before the attack evaporated. CVG's price declined 99% in the Curve liquidity pools, nosediving to $0,0004 from trading around $0.12 earlier today.

Convergence asked users not to interact with the protocol.

Edited by Stephen Alpher.

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

DeFi Protocol Convergence Hacked, CVG Token Plunges 99% on Curve

The exploiter created 58 million of the protocol's CVG token and then swapped for roughly $200,000 worth of wrapped ETH and crvFRAX and forwarded to Tornado Cash.