Conic Finance hack — July 2023

On 21 July 2023 an attacker drained the ETH Omnipool of Conic Finance, a protocol that spread user deposits across Curve pools, taking 1,724 ETH worth about $3.2 million. Conic's core team was alerted by threat-monitoring firm Hexagate at 10:51 UTC.

Conic's post-mortem attributes the attack to read-only reentrancy. Its oracle decided whether a Curve pool held ETH by looking for the 0xeee...eee placeholder address; Curve v2 pools hold WETH instead, so the check returned false and the reentrancy guard for the rETH pool was never applied. With the guard bypassed the attacker could re-enter during a Curve operation, read a manipulated price for the rETH Curve LP token, and cycle deposits and withdrawals to take out more than had been put in. CertiK's analysis records the attacker flash-borrowing roughly $134 million in total - 20,000 stETH from Aave plus 20,550 rETH, 3,000 cbETH and 28,504.2 WETH from Balancer - to move the pool price far enough. BlockSec's Matthew Jiang said the flash-loaned stETH was used to amplify the profit.

Hours later a second, separate problem hit the crvUSD Omnipool: bots arbitraged the imbalance, and Conic shut all Omnipools starting with that pool at 19:23 UTC. Conic's post-mortem puts the crvUSD episode at about $934,000 gross, of which roughly $300,000 was captured as profit; one operator returned 81.30 ETH, about $150,000, under a negotiated bounty. Totals across both episodes are reported between $3.2 million and $3.5 million depending on what is counted, with DL News giving a combined $3.3 million.

Conic disabled deposits and set up a debt pool for affected depositors. Deposits fell from about $156 million before the attacks to under $600,000, recovered to over $30 million during 2024 before settling around $5 million, and the team shut the protocol down on 7 March 2025 after failing to fix flaws found in a new version.