Curve Finance's factory pools have been hit by a reentrancy vulnerability, which allowed attackers to drain funds or exploit the contract's logic. The vulnerability led to significant outflows across various associated pools, resulting in over $26 million being lost. The attacker targeted Curve's factor pools of multiple projects, including JPEGd, Metronome, and Alchemix. The attack involved a sequence of interactions initiated with a flashloan, which appears to exploit the reentrancy vulnerability associated with certain compiler versions of Ethereum smart contract programming language Vyper. Investigations are ongoing, but there are speculations that whitehat hackers could be involved in a rescue operation.