Ethical Hacker Saves the Day: Recovers $5.4M for Curve Finance Amid Exploit, Unmasks Fake Refund Scam