Curve Finance (CRV): how the stablecoin exchange works, crvUSD, Llamalend and its risks

Curve Finance is a decentralised exchange built for tokens that should trade at nearly the same price, such as two dollar stablecoins or two versions of ether. Since 2023 it has also issued its own stablecoin, crvUSD, and run lending markets around it. DefiLlama counted $1.27 billion locked across Curve’s products on 26 October 2026, $1.16 billion of it in the exchange pools. In January 2022 those pools held more than $24 billion.

Swaps are now the quiet part of the business. Lending is where Curve grew in 2026: Llamalend v2 went live on Ethereum on 15 July, and active loans rose 68% in the third quarter, according to figures the protocol gave crypto.news. Governance has been less calm. In December 2025 the DAO turned down a funding request from the company run by founder Michael Egorov, while YieldBasis, a separate protocol he built on crvUSD, now holds more deposits than any Curve deployment outside Ethereum.

Curve Finance TVL, volume and fees in October 2026

The first pools opened in early 2020: DefiLlama’s earliest data point, on 9 February 2020, shows $1.16 million deposited. The CRV token and the DAO contracts followed on 13 August 2020, and deposits passed $1 billion within days, The Defiant reported in a piece republished by Decrypt. The peak came on 5 January 2022, at $24.30 billion.

Measure (DefiLlama, Curve DEX)	Value on 26 October 2026
Trading volume, last 24 hours	$103.0 million
Trading volume, last 30 days	$2.37 billion
Trading volume, last 365 days	$68.4 billion
Trading volume, all time	$353.7 billion
Fees, last 30 days	$3.19 million
Fees, last 365 days	$55.7 million
Fees, all time	$684 million

Curve’s monthly recaps point the same way. July 2026 volume fell 42% on the month to $3.40 billion, with $2.96 million of fees; August brought $3.19 billion and $3.04 million. Users went the other way. Daily active users hit 4,900 in early February 2026, a record by Curve’s count, against fewer than 1,000 in 2023.

DefiLlama lists 32 chains for the exchange, yet the money sits almost entirely on Ethereum: $1.106 billion of $1.165 billion on 26 October, about 95%. Fraxtal ($9.8 million), Monad ($9.6 million), Etherlink ($8.5 million) and Arbitrum ($6.6 million) trail far behind. New deployments keep coming anyway, with contracts on Robinhood Chain in July 2026 and, on 17 September, a launch on Arc, the layer 1 Circle built for stablecoin finance.

Date	Value locked in Curve pools (DefiLlama)
31 December 2020	$1.40 billion
31 December 2021	$23.07 billion
31 December 2022	$3.61 billion
31 December 2023	$1.68 billion
31 December 2024	$2.28 billion
31 December 2025	$2.11 billion
26 October 2026	$1.16 billion

DefiLlama’s series do not always count the same things, so read the history as a direction. CRV locked in veCRV, worth about $289 million on 26 October, stays out of the headline figure.

How does Curve Finance work? Stableswap pools versus Uniswap

Like other automated market makers, Curve has no order book. Traders swap against liquidity pools, contracts holding two or more tokens, and a formula sets the price from the balances. What separates Curve from Uniswap is that formula.

Uniswap v2 keeps the product of the two balances constant, so every trade moves the price, even between two coins both worth a dollar. Egorov’s StableSwap white paper, dated 10 November 2019, blends that rule with a constant sum, where tokens swap one for one. An amplification coefficient, A, sets the blend. With a low A the pool behaves like Uniswap; with a high A it stays close to a flat one-for-one rate.

So a large USDC-to-USDT swap costs little in slippage while the pool is balanced. Once one side runs short, pricing bends back toward the constant-product rule and the rate moves fast. That bend protects liquidity providers: if one coin loses its peg, nobody can drain the good coin from the pool at par. A is set pool by pool, and the DAO can change it.

Metapools, audited by Quantstamp in October 2020, pair a new token with the LP token of an existing pool, so a small stablecoin borrows a large pool’s depth. Stableswap-NG, the current generation, passed 1,000 pools on Ethereum in July 2026, Curve says.

Crypto pools for assets that float

A second design followed in 2021 for pairs that do not share a peg, such as the three-asset Tricrypto pools. ChainSecurity audited Tricrypto on 29 September 2021 and Tricrypto-NG on 23 June 2023. Retuning one is a DAO decision. In July 2026 a vote to change TricryptoUSDT’s parameters failed, 369 million veCRV against and 118 million for. Four days later the same text passed as Vote 1460, 538 million to zero.

FX pools and tokenised funds

Curve now pitches itself as a venue for on-chain currency trading. Its Arc announcement counted more than 20 active FX pools across 10 currency corridors on five other networks. Fidelity’s tokenised money market fund, FIDD, trades in Curve pools.

CRV token and veCRV: emissions, gauges and the Curve wars

CRV, the Curve DAO token, has a maximum supply of about 3.03 billion, according to Curve’s documentation. The docs split it into 57% community emissions to liquidity providers, 26.4% core team, 5% early users, 5% community reserve, 3.6% investors and 3% employees. Everything outside emissions has vested, the last tranche in August 2024. The token counts on that page add up to more than the maximum supply, so we quote only the percentages.

Emissions began at about 279.6 million CRV a year and drop by about 15.9% every 12 months. Epoch 6 opened on 12 August 2026 and cut the yearly flow to about 97.2 million CRV, from 115.5 million: the first time below 100 million. Annual inflation fell from 4.80% to 4.03% of supply, according to Curve’s emission post of 13 August. The next cut is due on 12 August 2027. The exact circulating supply is not stated in the documentation, and we give no figure.

To get a say, holders lock CRV as veCRV for anything from one week to four years. veCRV cannot be transferred. It brings votes on proposals and on gauge weights, a boost of up to 2.5 times on a liquidity provider’s own CRV rewards, and a cut of weekly fees. About 850.2 million CRV was locked at the end of August 2026.

Half of each pool’s trading fee is the admin share, per Curve’s documentation, and it reaches veCRV holders in crvUSD: the protocol sells what it collects through CoW Swap orders and pays holders through a fee distributor contract. In the week to 22 October 2026 veCRV holders shared $152,400, an annual rate of 2.762%, Curve’s Week 43 report shows. The rate had peaked near 5.4% in June.

The Curve wars

Gauge votes decide which pools get the weekly CRV emissions, and emissions pull in deposits, so veCRV became something to fight over. From 2021, protocols such as Convex, Yearn and Stake DAO piled up locked CRV. Convex locks CRV, issues cvxCRV in exchange and lets holders of its own CVX token steer the votes; bribe markets such as Votium pay voters to back a given pool. We found no reliable 2026 figure for Convex’s share of veCRV. How much these blocs weigh showed in December 2025, in the vote on Egorov’s company described below.

crvUSD stablecoin and LLAMMA soft liquidation

crvUSD is an over-collateralised stablecoin: users deposit assets such as ether or bitcoin tokens and mint crvUSD against them. Curve released the white paper and code in November 2022, The Block reported, and deployed the contracts on Ethereum on 3 May 2023. DefiLlama counted $221.5 million in circulation on 26 October 2026. Debt minted by borrowers stood at $68.2 million on 22 October, at an average rate of 3.3%.

What sets it apart is the way it treats falling collateral. In most lending protocols, a loan that crosses a threshold is sold off at once, a liquidation. crvUSD uses LLAMMA (Lending-Liquidating AMM Algorithm), which spreads collateral across a range of price bands. As the price falls through them, the contract converts collateral into crvUSD bit by bit, and buys it back if the price recovers. Curve calls this soft liquidation.

It has a cost. Curve’s own introduction warns that the conversions incur losses and can still end in full liquidation.

PegKeeper contracts hold crvUSD near a dollar by adding it to, or taking it from, selected Curve pools; they carried 33.75 million crvUSD of debt in the Week 43 report. The peg came under test in early February 2026. On 5 and 6 February the DAO passed Votes 1340 to 1344: a bigger revenue share for savers, a rate formula less sensitive to crvUSD’s price, a 400,000 crvUSD reserve the emergency DAO can draw on, and the power for that emergency DAO to soft-pause YieldBasis pools. The lowest price over May and June was $0.9974.

Savers can hold scrvUSD, a yield-bearing version built on Yearn’s V3 vaults and announced on 13 November 2024. It earns part of the interest borrowers pay, 3.3% a year in the Week 43 report. The DAO sets that share and raised it from 50% to 80% with Vote 1340. ChainSecurity audited scrvUSD on 3 December 2024.

Llamalend v2: Curve’s lending markets in 2026

Llamalend is Curve’s lending product. Lenders supply assets to isolated markets, and borrowers post collateral managed through LLAMMA’s bands. Statemind audited the first version on 2 February 2024; we could not confirm when it opened to the public.

Version 2 started on Optimism on 9 June 2026. Markets opened with a borrowing cap of zero until a seven-day DAO vote set one. Optimism added OP token incentives (250,000 OP according to The Block, 100,000 OP in Curve’s recap). Egorov told The Block he wanted live use from the start: “We want real economic activity to actually test it.”

Ethereum followed on 15 July (Curve’s launch post). Each market is isolated and one-way, with one collateral asset and one borrowed asset, and supported Curve LP tokens can serve as collateral while still earning trading fees. The DAO takes a 10% admin fee. The first Ethereum markets, sDOLA and sfrxUSD, were activated on 21 July with caps of 12.4 million and 28.4 million crvUSD; syrupUSDC came on 24 July, its 51.8 million cap approved on 2 August. Vote 1505, executed by 22 October, raised the sDOLA cap to 25 million.

A market against svZCHF, the savings token of the Frankencoin Swiss franc stablecoin, opened on 12 August. By 30 September lenders had supplied about 458,000 crvUSD and eight loans had drawn 240,000.

Growth figures depend on the source. Curve reported active loans up 68% in the third quarter, to $70.9 million, as relayed by crypto.news on 15 October. The Week 43 report adds version 1, version 2 and the crvUSD mint markets together and shows $257 million locked, $145 million borrowed and 1,227 loans on 22 October. The two numbers measure different things.

A 16 October 2026 headline said Curve now lets users borrow against LP tokens. That is not new: LP collateral has been part of version 2 since June, and version 1 markets are being retired. We found no published audit of Llamalend v2 on Curve’s audit page as of 26 October 2026, and the Week 43 report lists 20-times looped yields on v2 markets, which multiply losses as fast as returns.

YieldBasis, Egorov’s bitcoin protocol built on crvUSD

YieldBasis aims to let depositors hold bitcoin in a Curve pool without the usual impermanent loss. It pairs bitcoin tokens (WBTC, cbBTC, tBTC) with borrowed crvUSD and holds the position at a constant two-times leverage, so the liquidity provider keeps plain bitcoin exposure plus fees. Its token, YB, can be locked as veYB. It is a separate project, but it runs on crvUSD credit granted by the Curve DAO.

The DAO approved a $60 million crvUSD credit line on 24 September 2025, with the first pools capped at $10 million. A second vote, executed on 14 October, lifted the line to 300 million crvUSD and allowed 100 million per pool; YB emissions began the next day at 10:00 UTC. Critics in the DAO pointed to the absence of a third-party risk review and of any cap tied to crvUSD’s size, Cointelegraph reported. Egorov said YieldBasis had been through six audits with a seventh under way; we found no report published by an auditor.

YieldBasis raised $5 million in a token round at a $50 million fully diluted valuation, The Block reported in February 2025, without naming the investors. A public sale followed on Kraken Launch and Legion from 1 October 2025 at $0.20 per token, a $200 million valuation. None of that money went to Curve.

Curve’s February 2026 recap put YieldBasis at about $220 million deposited. DefiLlama showed $113.7 million on 26 October, all on Ethereum, though the two sources measure differently. On 1 September the caps of the two largest bitcoin markets were raised to $50 million each. Egorov’s February 2026 roadmap sees crvUSD supply reaching tens of billions as YieldBasis grows.

Curve Finance founder Michael Egorov, the DAO and Swiss Stake

Michael Egorov wrote the StableSwap paper and founded Curve in 2020; he earlier co-founded NuCypher, according to The Block’s profile. He manages Swiss Stake AG, the development firm that asks the DAO for funding. Decisions are taken on chain by veCRV votes, which need a quorum: Vote 1350 failed on that count in February 2026 and passed when resubmitted as 1353.

In December 2025 Swiss Stake asked for 17.4 million CRV, about $6.2 million, for its 2026 work. The DAO said no, by 54.46% to 45.54%, and wallets linked to Yearn and Convex cast nearly 90% of the votes against, The Defiant and Invezz reported. A request of more than 21 million CRV had passed with nearly 91% in August 2024. Swiss Stake still wrote the H1 2026 progress report, which announced a plan to raise the DAO’s share of protocol fees from 10% to 30%; we have not seen it put to a vote.

Risk oversight changed hands over the summer. LlamaRisk’s engagement ended on 30 June 2026, and it returned the unvested rest of its crvUSD stream (Vote 1441). Nine teams bid to replace it. The DAO picked yRisk with 537 million veCRV for and none against, for a one-year mandate paid with 125,000 frxUSD and 568,181 CRV, executed on 2 September.

Two votes close on 29 October 2026. Vote 1510 moves the emergency DAO to new proxy contracts on Ethereum, Arbitrum, Optimism, Sonic and Taiko, on yRisk’s advice, and extends its reach to Llamalend v2. Vote 1509 doubles the crvUSD lending limit of the sreUSD market, from 30 million to 60 million.

Curve Finance security record: incidents from 2020 to 2026

Six years of operation have brought one major exploit of Curve’s own pools and a string of close calls around them.

August 2020: a launch by a stranger

On 13 August 2020 an anonymous account deployed the CRV and DAO contracts, paying about $8,000 in gas, before the team did. Curve checked the code and admin keys, found them correct and went ahead. “We had no choice but to adopt it,” the team said, as quoted by The Defiant.

30 July 2023: the Vyper compiler exploit

Vyper, the language Curve’s pools are written in, shipped a broken reentrancy lock in versions 0.2.15, 0.2.16 and 0.3.0. On 30 July 2023 attackers used it against four pools: pETH/ETH (JPEG’d), msETH/ETH (Metronome), alETH/ETH (Alchemix) and CRV/ETH. The LlamaRisk post-mortem counts 6,106.65 WETH, about $11 million, taken from the pETH pool and about $22.6 million from the alETH pool. A whitehat, c0ffeebabe.eth, took 2,879.65 ETH from CRV/ETH first and gave it back.

Totals depend on who counts. Cointelegraph put the loss at $61.7 million on 4 August 2023. CertiK counted $69.3 million affected, of which $16.7 million came back through whitehats, leaving about $52 million, and Halborn’s figures are close. The attacker also sent 4,820.55 alETH back to Alchemix, Cointelegraph reported. LlamaRisk placed the flaw in the compiler, not in the pool code.

2023 and 2024: the founder’s CRV loans

The exploit came at a bad time for Egorov’s own position. In June 2023 he had deposited 38 million CRV on Aave and borrowed more than $64 million in stablecoins; The Block counted 277 million CRV pledged in all, then 32% of the circulating supply. After the hack he sold about 50 million CRV over the counter at $0.40 to buyers including Justin Sun and DWF Labs, Cointelegraph reported on 2 August 2023. These were personal deals, not DAO funds.

The pressure came back on 12 and 13 June 2024. Arkham counted $95.7 million borrowed, mostly crvUSD, against $141 million of CRV across five accounts on five protocols. On the morning of 13 June about $22.6 million of CRV collateral was liquidated within four hours, according to Parsec, and CRV fell 27.5% in a day to $0.261, Forklog reported from CoinGecko data. Part of the debt sat on Curve’s own lending markets, where rates jumped after a trader withdrew 6 million crvUSD.

2025 and 2026: trouble at the edges

On 26 June 2025 Resupply, a stablecoin protocol linked to Convex and Yearn, lost about $9.6 million. The attacker inflated the price of cvcrvUSD, a vault token built on crvUSD, in a thin market and borrowed nearly $10 million against one wei of collateral, Decrypt reported. The bug was in Resupply’s own lending contract.

The October 2025 crash left a Llamalend market that lent against CRV about $700,000 underbacked, The Block reported on 27 April 2026. Egorov proposed letting the vault’s shares trade in a stableswap pool centred near 71% solvency, a recovery mechanism that is “not a donation but an investment vehicle for everyone who participates”, he said. The recovery pool opened on 1 May and drew $141,000 in its first week. Curve’s model puts the start of recovery near a CRV price of $0.957 and full recovery near $1.242. CRV traded near $0.34 at 19:22 UTC on 26 October 2026.

Smaller episodes followed in 2026. A March exploit hit 27 positions in an sDOLA market, and Vote 1437 set up a gauge worth up to 5 million CRV for the borrowers. In April Curve paused LayerZero bridging as a precaution, then reopened it chain by chain with limits of 10,000 CRV. On 27 May Stake DAO’s vsdCRV token was exploited, forcing a controlled exit from a related Curve pool and lending market; the largest single repayment was $417,000, and Vote 1418 ended their CRV emissions. We found no Curve exploit reported in October 2026.

Curve Finance audits: 19 reports, none yet for Llamalend v2

Curve’s documentation lists 19 audit reports on its audits page, from Trail of Bits on the DAO contracts (10 July 2020) to ChainSecurity on cross-chain governance (17 September 2025). MixBytes and ChainSecurity reviewed crvUSD in 2023, 2024 and 2025, Statemind the first lending markets in February 2024.

Two gaps stand out. Llamalend v2, live since June 2026, has no report on that page as of 26 October. And an audit checks the code it is given: the 2023 losses came from the compiler that turned audited code into contracts.

Our Curve Finance risk rating: 3 out of 5

We rate Curve 3 on a scale where 1 is the lowest risk. In its favour: an exchange running since 2020 and a long list of published audits. Against it: the 2023 exploit, bad debt still unrecovered in one lending market, a newer lending version without a published audit, and 95% of deposits on a single chain.

Governance adds risk of its own: a few large holders can decide votes, and crvUSD demand leans on YieldBasis, run by Curve’s founder outside the DAO. This is a reading of the record as of 26 October 2026, not investment advice.

Next dates: the 29 October votes and the 2027 emission cut

Votes 1509 and 1510 close on 29 October 2026. The plan to lift the DAO’s fee share from 10% to 30% has no vote date yet. yRisk’s one-year mandate runs from September 2026, and the next CRV emission cut falls on 12 August 2027, when the daily rate drops to about 223,800 CRV, according to Curve.