Curve LlamaLend exploit analysis
Curve LlamaLend's fee-share rounding slippage let the attacker walk the slippage out across many small withdrawals. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- ~240,000 US$, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-03-02: Share Price Manipulation on Curve LlamaLend”.
Analysis1 min read
Curve LlamaLend's remove_liquidity_one_coin shared the AMM's withdrawal fee with the depositor as a kind of incentive. The fee-sharing accounted in balanceOf for the depositor but in totalUnderlying for the AMM, leaving a rounding slippage the attacker exploited.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; total loss is captured in the PoC.
What would have prevented it: a fee share that reads totalUnderlying consistently for both the depositor's balanceOf and the AMM's accounting.
Other exploits
- StakeOnMe exploit analysis 15 Mar 2026
- Venus THE exploit analysis 15 Mar 2026
- AlkemiEarn exploit analysis 10 Mar 2026
- LAXO Token exploit analysis 22 Feb 2026
- XDKRecycle exploit analysis 16 Feb 2026
- Moonwell February 2026 exploit analysis 15 Feb 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
