How much was lost in the Conic Finance hack?

$3.2M Read-Only Reentrancy, as publicly reported (July 21, 2023).

Conic Finance Hack: $3.2M Read-Only Reentrancy

Q: How was the Conic Finance hack carried out?

Single-Transaction Drain. The attacker exploited read-only reentrancy against the ETH omnipool's price oracle, extracting roughly 1,700 ETH in one transaction to the attacker address below.

July 21, 2023 · Ethereum

stolen

$3.2M

addresses traced

138

transfers

951

core exploit

1 tx

What happened

On July 21, 2023, Conic Finance — an omnipool protocol built on the Curve ecosystem that spread deposits across multiple Curve pools — lost approximately $3.2M from its ETH omnipool. The attacker exploited a read-only reentrancy vulnerability: by re-entering during a Curve pool interaction, they manipulated the price the protocol's oracle read, and drained roughly 1,700 ETH in a single transaction. The hit came just days after a separate, smaller incident affecting one of Conic's Curve pools — a brutal one-two punch for the young protocol. ChainHint's trace of the exploiter's flow is short, and the strip above gives its exact size.

How the funds moved

Step 1

Single-Transaction Drain

The attacker exploited read-only reentrancy against the ETH omnipool's price oracle, extracting roughly 1,700 ETH in one transaction to the attacker address below.

Step 2

Minimal Movement

Unlike large-scale laundering operations, the traced flow is tiny — the transfer count in the strip above is the whole of it, over two hops.

Step 3

Cold Endpoints

The trail terminates at an address flagged scam-linked in our database and at the labelled exploiter. Neither is an exchange deposit, so neither carries a KYC record to request.

Where the funds went

Read from the transfers in ChainHint's trace, not from press reports

First transfer

Jul 21, 2023

Last transfer traced

Sep 29, 2026

Hops traced

DEX swaps

First hop out of the attacker's address

$3.27METH

ChainHint's trace of the Conic Finance hack follows 951 transfers across 138 addresses and 6 hops, between Jul 21, 2023 and Sep 29, 2026. The first hop out of the attacker's address moved ETH ($3.27M). 15 of the transfers are DEX swaps.

Visualized attack path

138 addresses · 951 transfers · Traced with ChainHint

View Interactive Graph →

Key findings

Attacker Address

0x8d67…c8aaReceived ~1,700 ETH from the ETH omnipool in a single exploit transaction.

Read-Only ReentrancyOracle Manipulation

Destination Pattern

Scam-flagged endpoint, no exchange depositFunds moved minimally and parked without reaching an exchange deposit address, so there is no KYC record to request.

Compounding Incident

Second hit in a single weekDays before the omnipool drain, a separate smaller incident hit one of Conic's Curve pools — two exploits against the same protocol within a week.

Repeat Target

Aftermath

Funds dormant at cold walletsThe traced ETH still sits at the endpoints this graph holds. Dormant funds can resurface years later — monitoring those addresses is the primary remaining lead.

Investigate your own incident

ChainHint traced the Conic Finance hack in minutes.
Use the same tool for your case.