Curve Review: Still the Cheapest Way to Move Large Stablecoin Sums
We ran stablecoin swaps through Curve's rebuilt interface, checked its post-hack recovery and its fee split, and weighed the 0.04% pool fee against how confusing the site still is for a first-time user.
7.6out of 107.6
Our verdict
Curve remains the cheapest venue we tested for moving a large stablecoin balance: the 0.04% pool fee undercuts nearly every centralized alternative once you account for the spread they hide. The 2023 exploit and the 73% recovery it managed are a real mark against it, and the interface still assumes you already know what a pool, a gauge and veCRV are. Anyone new to DeFi should practice with a small amount first; anyone moving five or six figures of stablecoins already knows why they are here.
Best for: Traders and treasuries swapping large stablecoin amounts who already hold a self-custody wallet
We came to Curve to move a stablecoin balance between USDC and USDT without paying a centralized exchange's spread, and left with a familiar reaction: cheapest tool in the drawer, ugliest handle. That tension has defined Curve since 2020, and it has not gone away.
A swap that costs a rounding error
We connected a wallet, picked a DAI/USDC/USDT pool and swapped 5,000 dollars between two stablecoins. The fee: 0.04%, split evenly between liquidity providers and veCRV holders. On our test trade that came to two dollars, before the Ethereum gas fee. A centralized exchange would have quoted a wider spread on the same pair, even before any withdrawal fee to get funds back on-chain. The swap screen itself still carries a warning to check that the domain reads curve.finance, a holdover from an August 2022 DNS hijack that cloned the front end and cost users about 570,000 dollars before the real site was restored.
That fee only stays this low because Curve's pools concentrate liquidity around assets that trade near a fixed price. Push a large stablecoin order through a pool and the price barely moves; try the same size on a volatile pair and Curve behaves like any other AMM, worse in some cases, since its curve is tuned for stable pairs, not general trading.
The pool list is not built for a first visit
We opened the pools page next and watched a wall of pair names, APY figures and small icons load with no explanation of what any of it means to someone who has not used a DEX before.
The pools page, listing the DAI/USDC/USDT stable pool among dozens of others
Clicking into a single pool goes deeper still: a deposit and withdraw screen with a price chart, gauge weights and boost multipliers that assume the visitor already understands veCRV locking.
A single pool's deposit screen, with its price history chart above the swap controls
None of this is a bug. Curve was built for people who already run DeFi positions elsewhere, and it still reads that way. A newcomer who wants to swap once should expect a learning curve before the low fee pays off, and should not lock funds into a pool or a gauge without first reading what unlocking costs in time or in slippage.
What the 2023 hack actually changed
In July 2023 a reentrancy bug in specific Vyper compiler versions let attackers drain an estimated 50 to 70 million dollars from several Curve pools. TVL fell from 3.26 billion dollars to 1.72 billion within a day. Curve recovered 73% of the stolen funds within two weeks, partly because one attacker returned 12.7 million dollars voluntarily, but the episode showed that a compiler-level flaw outside Curve's own code could still cost users real money.
A second incident followed in March 2026: an oracle-manipulation exploit against an sDOLA/crvUSD lending market on LlamaLend triggered hard liquidations for 27 borrowers. It was smaller and contained to one market rather than the core pools, but it is a reminder that Curve's growing stack, crvUSD and LlamaLend on top of the original AMM, adds new places for something to go wrong.
Where the numbers sit today
Total value locked is roughly 1.4 billion dollars as of September 2026, still below the pre-hack peak. crvUSD minted grew about 29% in July 2026 to 36.7 million dollars, with collateral backing it up 43% to 70.5 million dollars, small next to giants like DAI but growing in the right direction.
DefiLlama's tracking page for Curve Finance, showing current TVL and fee revenue
Curve still captures around 44% of all DEX fees on Ethereum, a sign that professional liquidity still routes through it even after two rounds of bad headlines.
crvUSD adds a second product inside the same site
Beyond swapping, Curve now lets users mint crvUSD against approved collateral without leaving the interface, a feature that pulls it closer to a lending protocol than a plain AMM. We did not open a position ourselves, since testing a leveraged borrow was outside what this review needed to answer, but the growth is real: minted crvUSD rose about 29% in July 2026 to 36.7 million dollars, with collateral backing it climbing 43% to 70.5 million dollars. That is still tiny next to DAI or USDC, and it means crvUSD's peg has less liquidity defending it than the giants it is chasing. Anyone holding crvUSD as a savings balance rather than actively managing a collateral position should treat it as a smaller, less battle-tested stablecoin, not an interchangeable substitute for USDC.
Our verdict
For a large stablecoin swap, Curve is still the tool we would reach for first: the fee is close to the theoretical floor and the liquidity is deep enough that size does not move price much. For anyone new to DeFi wanting to try a first on-chain swap, we would point them somewhere with a simpler interface and accept a slightly higher fee for the clarity, at least until they understand what a pool and a gauge actually do. Once that basic vocabulary sticks, Curve's fee advantage is large enough to be worth the trip back.
What we liked
0.04% swap fee on stablecoin pools, among the lowest of any venue we checked
Deep liquidity means large stablecoin swaps move price far less than on a typical centralized order book
crvUSD lets users borrow against collateral directly inside the same interface
No account, KYC or deposit step; connect a wallet and the pool list loads
What held it back
The pool list and swap screen use DeFi terms (gauges, veCRV, LlamaLend) with no explanation for a first-time visitor
A July 2023 reentrancy exploit drained roughly 50 to 70 million dollars from several pools before 73% was recovered
A separate March 2026 exploit on an sDOLA/crvUSD lending market triggered hard liquidations for 27 borrowers
Total value locked sits near 1.4 billion dollars, down from a 3.26 billion dollar peak before the 2023 hack
Specs
Stablecoin pool fee
0.04% (0.02% to LPs, 0.02% to veCRV holders)
Custody
Non-custodial; user's wallet holds funds and keys at all times
Total value locked
About $1.4 billion as of September 2026, per DefiLlama
2023 exploit loss
$50-70 million across several pools; 73% later recovered
2026 exploit
March 2026 oracle-manipulation exploit on an sDOLA/crvUSD LlamaLend market, 27 borrowers hard-liquidated
Native stablecoin
crvUSD, minted against DAO-approved collateral
DEX fee share
Roughly 44% of all Ethereum DEX fees captured, per independent trackers
