Whitehat requests return of ~1.39 ETH extracted via front-run of their Curve LlamaLend leverage bundle, offering 10% bounty to attacker c0ffeebabe.
Security & Exploits ·
A wallet holder has submitted an on-chain message requesting the return of approximately 1.39 ETH that was extracted through a front-run exploit targeting their Curve LlamaLend leverage position. The sender, operating from 0x7bdfe11c4981dd4c33e1aa62457b8773253791b3, is offering a 10% bounty (0.14 ETH) to the account c0ffeebabe, which executed the extraction, and requesting return of the remaining 1.25 ETH.
The incident occurred on February 26, 2026, when the sender attempted to add leverage to a Curve LlamaLend loan by posting 600.6 yCvxCRV collateral and borrowing 3,150.37 crvUSD through a custom Enso bundle. A bot controlled by c0ffeebabe executed the identical transaction steps in the same block, using approvals the sender had granted to Enso's contracts, and redirected the borrowed funds—worth approximately 1.39 ETH after a swap to Ethereum—to itself. The sender's own transaction failed as a result, leaving the 3,150.37 crvUSD debt on their loan, which they repaid from personal funds.
The sender attributes the exploit to improper approval settings in their bundle design and states they have since revoked the problematic permissions. The message acknowledges c0ffeebabe's reputation for returning funds when requested and offers the partial bounty as compensation for returning the majority of the extracted amount to the specified address.