Convergence Protocol Hacked: $210 Million in CVG Tokens Minted and Dumped，Token Price Plunges Nearly 100%

Decentralized finance protocol Convergence was hacked on August 1 due to a smart contract exploit. The attacker minted and sold $210 million worth of the platform's native token, CVG, and stole an additional $2,000 in unclaimed staking rewards.

Details of the Exploit

The attack targeted the CvxRewardDistributor contract, allowing the hacker to mint 58 million CVG tokens, which were then sold for approximately $210,000. Additionally, around $2,000 in unclaimed rewards from Convex, another DeFi protocol, were stolen. The incident occurred at approximately 3:00 am UTC, according to Etherscan data.

Blockchain security firm PeckShield reported that the attacker quickly exchanged the stolen CVG tokens for 60 wrapped Ether and 15,900 Curve.fi FRAX. This action led to a nearly 100% collapse in the CVG token's price, which is now trading at $0.0004, with a market cap of just $57,000, as per CoinMarketCap.

Cause and Response

Convergence revealed that the attack was possible due to the accidental removal of a critical line of code in the smart contract, intended for gas optimization. This omission left the staking contract vulnerable, allowing the hacker to exploit the claimMultipleStaking function. The malicious actor minted all tokens meant for staking emissions and then dumped them into CVG liquidity pools.

In a statement, the Convergence team apologised to the community and investors, acknowledging full responsibility for the oversight. They assured that user funds remained safe and advised users to withdraw assets from the platform. The team is working on fixing the broken rewards contract for the Stake DAO integration, assuring users that their rewards will be claimable once the issue is resolved. They also promised further communication about the protocol's future.

Impact and Broader Context

Convergence, a platform designed to aggregate liquidity and enhance returns within the Curve Finance ecosystem, saw its total value locked (TVL) drop from $5.79 million to $3.69 million following the hack, according to DefiLlama data.

The incident adds to a series of crypto hacks, with the ecosystem losing around $266 million in July alone. This includes the significant $230 million hack of the Indian trading platform WazirX on July 18.