Curve LlamaLend (sDOLA-long2 market) hack — March 2026

A Curve LlamaLend market that lent crvUSD against sDOLA, the yield-bearing version of Inverse Finance's DOLA stablecoin, was manipulated on 2 March 2026 in a transaction at 03:00:11 UTC, and 27 of its 30 borrowers were hard-liquidated. The post-mortem, written by LlamaRisk with Swiss Stake, CurveDocs and Wavey, puts the attacker's net profit at about $245,000 and the borrowers' equity seized through the liquidations at about $822,475. Lenders lost nothing. BlockSec Phalcon and CertiK put the loss at about $240,000 the same day, and Inverse Finance stressed that its own contracts were not affected.

According to the post-mortem, the attacker borrowed about $46m of USDC and WETH from Morpho, converted it to crvUSD and swapped 13.25m crvUSD into the market's LLAMMA, its soft-liquidation AMM, buying 9.83m sDOLA and pushing every position into soft liquidation. It then staked DOLA into the sDOLA vault, which raised sDOLA's exchange rate, and so the oracle price, by 13.79%, from 1.189 to 1.353. That left the soft-liquidated positions instantly unhealthy, and liquidating them sold about $11.73m of collateral to repay about $10.9m of debt.

This registry read the transaction: the attacker's addresses ended it with 227,325.57 DOLA and 6.74 WETH, about $240,000 at that hour's prices. The post-mortem's $245,000 profit is recorded as the amount taken, with the borrowers' $822,475 as the upper end. The market is being wound down, and the post-mortem sets out no reimbursement plan.