{"investigation":{"slug":"resupply","entity_name":"Resupply","trust_score":27,"severity_base":null,"score_modifier":-5,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Resupply (also known as ResupplyFi) is a stablecoin lending protocol built by Convex Finance and Yearn Finance contributors as the successor to Prisma Finance, which was exploited for $11.6 million in 2024. In June 2025 an ERC-4626 donation attack on a newly deployed vault stole an estimated $9.3–9.8 million, laundered through Tornado Cash, and the team's response drew criticism. The resulting $10 million of reUSD bad debt was reported fully repaid by August 2025 through an insurance pool burn, treasury and developer contributions, and a Yearn loan.","sections":[{"content":"Resupply (also known as ResupplyFi; resupply.fi / resupply.finance) is a decentralized stablecoin lending protocol, structured as a collateralized debt position (CDP) system, that lets users supply crvUSD or frxUSD into Curve Lend (LlamaLend) or Fraxlend markets and borrow its native stablecoin, reUSD, against those yield-bearing positions. It operates as a subDAO developed jointly by contributors from Convex Finance and Yearn Finance, which Convex confirmed on its official X account; no individual founders are publicly named. Collateral deposited into Resupply is automatically staked on Convex Finance, earning additional CRV and CVX rewards. Protocol fees go to RSUP stakers, the insurance pool (a mechanism intended to absorb losses from at-risk positions) and the treasury. Token distribution allocates 20% to the Convex sub-DAO and 10% to the Yearn sub-DAO, both vesting over five years, and 2% to the team over one year. RSUP has no maximum supply and follows an inflation schedule, with initial emissions split 50% to voting incentives, 25% to the insurance pool and 25% to CDPs. The team describes the contracts as immutable and non-custodial. The protocol was conceived in December 2024 and officially launched on March 20, 2025. In its first week it generated about $44,700 in fees, with $35 million of reUSD minted against $42 million of collateral; TVL reached roughly $135–136 million before the June 2025 exploit.","heading":"Overview and design","sources":[{"url":"https://x.com/ConvexFinance/status/1876252394045985148","name":"Convex Finance on X — Resupply announcement","type":"official","credibility":3},{"url":"https://docs.resupply.fi/resupply-governance/tokenomics","name":"Resupply documentation — Tokenomics","type":"official","credibility":3},{"url":"https://resupply.finance/","name":"Resupply Official Website","type":"official","credibility":1},{"url":"https://iq.wiki/wiki/resupply-usd-reusd","name":"Resupply USD (reUSD) — IQ.wiki","type":"other","credibility":3},{"url":"https://outposts.io/article/convex-and-yearn-launch-resupply-protocol-with-yield-bearing-dc94dbfb-4331-49ee-bde9-7c77b71c24cf","name":"Convex and Yearn Launch Resupply Protocol with Yield-Bearing Stablecoin reUSD — Outposts","type":"news_article","credibility":2},{"url":"https://iq.wiki/wiki/resupply","name":"Resupply — Projects & Protocols | IQ.wiki","type":"other","credibility":2}],"severity":"low"},{"content":"Resupply was formally introduced through Prisma Finance governance proposal PIP-46, which passed in late 2024 and called for shutting down Prisma Finance and introducing Resupply, built on the FraxLend codebase by Convex and Yearn contributors, as its successor; PRISMA holders were allowed to redeem for vesting RSUP tokens. Prisma had suffered an $11.6 million exploit on March 28, 2024 through its MigrateTroveZap contract, after which its TVL fell from approximately $220 million to $107 million and never recovered. Prisma's attacker claimed the exploit was a 'whitehat rescue', a claim the community disputed.","heading":"Predecessor: Prisma Finance","sources":[{"url":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232","name":"PIP-46: Shutdown Prisma Finance, introduce Resupply — Prisma governance forum","type":"official","credibility":3},{"url":"https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","name":"Prisma Finance hacker claims $11.6 million whitehat rescue — CryptoTimes","type":"news_article","credibility":3},{"url":"https://immunebytes.com/blog/prisma-finance-exploit-march-28-2024-detailed-analysis/","name":"Prisma Finance exploit March 28, 2024 — Immunebytes","type":"research","credibility":3},{"url":"https://cointelegraph.com/news/prisma-finance-exploited-10-million","name":"Prisma Finance exploited — Cointelegraph","type":"news_article","credibility":3}],"severity":"medium"},{"content":"Resupply was exploited through a newly deployed lending pair for the crvUSD-wstUSR market (the vault is referred to as crcrvUSD on one page and cvcrvUSD on another). Reports differ on the date and timing: one page dates the attack June 26, 2025 and says the vault had been live for about 95 minutes, while the other gives June 25–26, 2025 and about two hours. Reports also differ on the amount stolen: approximately $9.6 million (Decrypt, CryptoTimes, CryptoRank), $9.5 million (CryptoPotato), $9.3 million (DL News), with a range of $9.3–9.8 million given overall. The attacker, initially funded via Tornado Cash, deployed two exploit contracts. According to BlockSec, the attacker flash-loaned 4,000 USDC from Morpho, converted it to crvUSD, donated about 2,000 crvUSD directly to the nearly empty vault and deposited a tiny amount (about 2 crvUSD for 1 wei of shares), inflating the vault's share price to an extreme level. Because the ResupplyPair contract computed its exchange rate as 1e36 divided by that price, Solidity's floor division rounded the rate to zero; the solvency check, which multiplied the borrow amount by that rate, then always passed. The attacker deposited 1 wei of collateral and borrowed the pair's full 10 million reUSD borrowing limit. The vulnerable patterns sit in ResupplyPairCore.sol at line 573 (exchange rate), lines 155–156 (ERC-4626 collateral acceptance) and line 282 (solvency check). The exploit transaction hash is 0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3 and the primary attacker address identified is 0x6D9f6E900ac2CE6770Fd9f04f98B7B0fc355E2EA. The root cause was the failure to seed the new vault with initial liquidity or to guard against the known ERC-4626 empty-vault donation attack; Halborn noted that Curve's own documentation already indicated applicability constraints for this implementation that Resupply did not account for.","heading":"June 2025 exploit: ERC-4626 donation attack","sources":[{"url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","name":"Explained: The Resupply Hack (June 2025) — Halborn","type":"research","credibility":2},{"url":"https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply","name":"Hacker Drains $9.6 Million From DeFi Stablecoin Protocol Resupply — Decrypt","type":"news_article","credibility":2},{"url":"https://www.guardrail.ai/blog/resupplyfi-hack","name":"Lessons from the Resupply exploit — Guardrail","type":"research","credibility":2},{"url":"https://cryptorank.io/news/feed/0ca5a-hacker-drains-9-6-million-from-resupply","name":"Hacker drains $9.6 million from Resupply — CryptoRank","type":"news_article","credibility":3},{"url":"https://rekt.news/resupplyfi-rekt","name":"ResupplyFi Rekt — Rekt News","type":"news_article","credibility":2},{"url":"https://ackee.xyz/blog/resupply-hack-analysis/","name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","credibility":2},{"url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2025/06/26/hacker-exploits-resupplyfi-bug-to-steal-9-6m-in-crypto/","name":"Hacker Exploits ResupplyFi Bug to Steal $9.6M in Crypto — CryptoTimes","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/resupplyfi-defi-exploit-wstusr-96m-loss","name":"ResupplyFi DeFi exploit wstUSR $9.6m loss — Cointelegraph","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The stolen reUSD was swapped through Curve and Uniswap into ETH; one page puts the proceeds at approximately 1,581 ETH in USDC and wrapped Ether. Funds were split across two secondary addresses holding approximately $5.5 million and $3.9 million. The attacker then routed approximately 2,280 ETH (roughly $9.8 million), as confirmed by PeckShield, and a separately reported 1,607 ETH (about $6.5 million at the time) through Tornado Cash. Tornado Cash was therefore used both to fund the attacker and to launder the proceeds. No recovery of funds or identification of the attacker had been publicly confirmed.","heading":"Fund flow and Tornado Cash laundering","sources":[{"url":"https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/","name":"ResupplyFi Exploiter Launders $9.8 Million in Stolen ETH Via Tornado Cash","type":"news_article","credibility":3},{"url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44","name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","credibility":2},{"url":"https://rekt.news/resupplyfi-rekt","name":"ResupplyFi Rekt — Rekt News","type":"news_article","credibility":2},{"url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","credibility":2}],"severity":"critical"},{"content":"reUSD depegged to approximately $0.98 after the exploit. TVL fell from approximately $135–136 million to between $78 million and $85 million as users withdrew funds. The team emergency-paused the wstUSR market and set its borrow limits to zero; only the wstUSR market was directly affected and the rest of the protocol continued to operate. The RSUP token came under sell pressure, with its market capitalization falling to about $7 million. Insurance pool withdrawals were paused and only became eligible to resume after the recovery plan was enacted within the original seven-day cooldown window.","heading":"Market impact","sources":[{"url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44","name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","credibility":2},{"url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/stablecoin-protocol-resupply-suffers-9-5m-exploit/","name":"Stablecoin protocol Resupply suffers $9.5M exploit — CryptoPotato","type":"news_article","credibility":3},{"url":"https://www.coinspeaker.com/resupply-fi-hacked-for-9-6m-who-has-been-affected/","name":"Resupply.fi hacked for $9.6M: who has been affected — Coinspeaker","type":"news_article","credibility":3},{"url":"https://rekt.news/resupplyfi-rekt","name":"ResupplyFi Rekt — Rekt News","type":"news_article","credibility":2}],"severity":"high"},{"content":"Resupply's documentation says its contracts were 'reviewed by peers and top security auditors' but its primary website does not name audit firms. According to Rekt News, ChainSecurity and yAudit (later rebranded Electi) reviewed the protocol three to four months before the exploit. Both firms initially said the exploited market was out of scope because the vault was deployed after their reviews; ChainSecurity later acknowledged that 'the code of the vaults which were later deployed were in scope of the audits, the deployment of those vaults and ensuring that they are securely initialized wasn't in scope.' The audit's trust model assumed meaningful collateral would be present at deployment, an assumption neither documented as a requirement nor enforced in code. Halborn, which published a post-mortem, was not a pre-exploit auditor of the affected contract. Researchers at Ackee Blockchain, Halborn, Veridise and Guardrail argued that initialization, especially enforcing minimum initial liquidity, is security-critical and belongs in audit scope; Veridise said the bug could have been caught by audit procedures focused on empty-vault edge cases. Cyvers co-founder Meir Dolev said the exploit 'could have been prevented with proper input validation, oracle checks, and edge-case testing.' The vulnerability only manifested when a new vault was deployed with zero liquidity within a narrow window.","heading":"Audit scope and security posture","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","name":"Explained: The Resupply Hack (June 2025) — Halborn","type":"research","credibility":2},{"url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/","name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","credibility":2},{"url":"https://auditium.io/resources/resupply/","name":"Resupply audit coverage — Auditium","type":"research","credibility":3},{"url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","credibility":2},{"url":"https://rekt.news/resupplyfi-rekt","name":"ResupplyFi Rekt — Rekt News","type":"news_article","credibility":2},{"url":"https://ackee.xyz/blog/resupply-hack-analysis/","name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","credibility":2},{"url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","credibility":2}],"severity":"high"},{"content":"The team's post-exploit communication was widely criticized. According to Crypto Labs, it issued only a three-sentence tweet and did not start a bounty programme or disclose chain-tracing efforts. Discord moderators allegedly banned users who raised critical questions, including investor Yishi Wang, founder of OneKey, who reportedly lost over $2 million. Wang called the recovery plan 'essentially a false insurance scheme' that shifted developer liability onto users, argued there was no DeFi precedent for using an insurance pool to cover developer-caused bugs, and called the incident 'not a black swan event; it is a man-made disaster, a serious oversight at the development level.' Curve founder Michael Egorov defended the plan, saying the bug was 'not the easiest thing to spot' and that insurance pools are designed for such circumstances; he also allegedly threatened legal action against Wang for 'smearing Curve's reputation', which drew further backlash. OneKey later clarified that Wang spoke as a private investor. AICoin's reporting describes the team as having 'mocked investors raising legitimate concerns.'","heading":"Post-exploit communication and governance controversy","sources":[{"url":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7","name":"Post-hack silence, governance failure: deconstructing Resupply's $9.6M — Crypto Labs (Medium)","type":"community_report","credibility":3},{"url":"https://www.aicoin.com/en/article/469162","name":"AICoin article on the Resupply governance controversy","type":"news_article","credibility":3},{"url":"https://www.panewslab.com/en/articles/176r70wk","name":"PANews — Resupply governance controversy","type":"news_article","credibility":3},{"url":"https://www.theblock.co/post/360226/resupply-six-million-burn","name":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","type":"news_article","credibility":2}],"severity":"high"},{"content":"The exploit left about $10 million of reUSD bad debt. Pages differ on how the first repayment was funded: one says the treasury repaid 2.86 million reUSD directly, while the other says over $2.87 million was repaid in the immediate aftermath from C2tP, a pseudonymous developer affiliated with Resupply and Convex who contributed $1.4 million of personal funds, $810,000 from the Convex treasury, and an initial treasury payment of about $600,000. On June 30, 2025, the team published a governance proposal to burn 6 million reUSD from the insurance pool, about 15.5% of its roughly $38.7 million holdings, to cover most of the remaining bad debt. The residual 1.13 million reUSD was to be carried by the DAO and repaid through protocol fees and RSUP revenue, with Yearn providing a loan for that portion. Resupply offered 2.5 million RSUP to encourage insurance pool depositors to stay, and requested a shortened three-day vote instead of the standard seven days, with implementation to start three days after approval. By August 2025 Resupply announced full repayment of the $10 million bad debt, using treasury funds, the insurance pool burn and support from the Convex and Yearn sub-DAOs ($8.8 million via the burn and contributions, $1.13 million via the Yearn loan). It also launched sreUSD, a savings product with an 'off-peg boost', and reUSD was trading near $0.99 at the time. Using user insurance funds to cover a developer error remains contested.","heading":"Recovery plan and bad debt repayment","sources":[{"url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/","name":"Resupply developer donates $1.4m after protocol suffers $9m exploit — DL News","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/360226/resupply-six-million-burn","name":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/","name":"Resupply Plans 6M reUSD Token Burn to Recover From $10M Hack — CryptoTimes","type":"news_article","credibility":2},{"url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","name":"Resupply protocol outlines recovery plan post $10M exploit, proposes $6M token burn — crypto.news","type":"news_article","credibility":2},{"url":"https://bitcoinethereumnews.com/tech/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","name":"Resupply protocol outlines recovery plan — BitcoinEthereumNews","type":"news_article","credibility":3},{"url":"https://www.ainvest.com/news/resupply-fully-repays-10-million-bad-debt-june-2025-exploit-2508/","name":"Resupply fully repays $10 million bad debt from June 2025 exploit — AInvest","type":"news_article","credibility":3},{"url":"https://www.binance.com/en/square/post/27733819837209","name":"Binance Square post on Resupply repayment","type":"social_media","credibility":3},{"url":"https://www.coingecko.com/en/coins/resupply-usd","name":"Resupply USD (reUSD) — CoinGecko","type":"other","credibility":3}],"severity":"medium"},{"content":"With the June 2025 exploit, the Convex and Yearn contributor lineage behind Prisma Finance and Resupply has been associated with two significant security incidents totalling over $21 million in losses. Crypto Labs described this as 'a troubling cycle of inadequate accountability', noting that Prisma's losses went unresolved for nine months before the rebrand. Security researchers placed the exploit within the well-documented ERC-4626 inflation attack class; BlockSec called it 'yet another lending protocol exploited via exchange rate manipulation on low-liquidity — even empty — markets.' Suggested mitigations include minimum initial deposits or 'virtual shares', checks that exchange rates cannot resolve to zero before solvency checks, treating deployment initialization as audit-critical, and real-time monitoring for anomalous borrowing. The exploit occurred amid reported 2025 crypto hack losses of $2.1 billion and added ResupplyFi to the Rekt News leaderboard.","heading":"Protocol lineage and repeat incidents","sources":[{"url":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7","name":"Post-hack silence, governance failure: deconstructing Resupply's $9.6M — Crypto Labs (Medium)","type":"community_report","credibility":3},{"url":"https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","name":"Prisma Finance hacker claims $11.6 million whitehat rescue — CryptoTimes","type":"news_article","credibility":3},{"url":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232","name":"PIP-46: Shutdown Prisma Finance, introduce Resupply — Prisma governance forum","type":"official","credibility":3},{"url":"https://cointelegraph.com/news/prisma-finance-exploited-10-million","name":"Prisma Finance exploited — Cointelegraph","type":"news_article","credibility":3},{"url":"https://ackee.xyz/blog/resupply-hack-analysis/","name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","credibility":2},{"url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/","name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","credibility":2},{"url":"https://www.guardrail.ai/blog/resupplyfi-hack","name":"Lessons from the Resupply exploit — Guardrail","type":"research","credibility":2},{"url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","credibility":2},{"url":"https://nabilech.com/resupplyfi-rekt-how-a-4k-flash-loan-led-to-a-9-8m-erc-4626-donation-attack/","name":"ResupplyFi Rekt: How a $4K Flash Loan Led to a $9.8M ERC-4626 Donation Attack","type":"news_article","credibility":3}],"severity":"high"}],"timeline":[{"date":"2024-03","event":"Prisma Finance, Resupply's predecessor, is exploited for $11.6 million via its MigrateTroveZap contract; TVL falls from about $220M to $107M.","source":"Prisma Finance exploit March 28, 2024 — Immunebytes","source_url":"https://immunebytes.com/blog/prisma-finance-exploit-march-28-2024-detailed-analysis/"},{"date":"2024-12","event":"Prisma governance proposal PIP-46 passes, shutting down Prisma Finance and introducing Resupply, built on the FraxLend codebase by Convex and Yearn contributors.","source":"PIP-46: Shutdown Prisma Finance, introduce Resupply — Prisma governance forum","source_url":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232"},{"date":"2024-12","event":"Resupply publicly introduced by Convex Finance and Yearn Finance.","source":"Convex Finance on X — Resupply introduced","source_url":"https://x.com/ConvexFinance/status/1869394912250314810"},{"date":"2025-01","event":"Convex Finance announces Resupply on X as a new stablecoin protocol developed jointly with Yearn.","source":"Convex Finance on X — Resupply announcement","source_url":"https://x.com/ConvexFinance/status/1876252394045985148"},{"date":"2025-02","event":"Security reviews by ChainSecurity and yAudit (Electi) completed about three to four months before the exploit, covering the ResupplyPair code but not deployment initialization.","source":"ResupplyFi Rekt — Rekt News","source_url":"https://rekt.news/resupplyfi-rekt"},{"date":"2025-03","event":"Resupply officially launches on mainnet, supporting Curve Lend and Fraxlend collateral for borrowing reUSD.","source":"Convex Finance on X — Resupply launch","source_url":"https://x.com/ConvexFinance/status/1902702988092735588"},{"date":"2025-05","event":"Resupply deploys a new LlamaLend market via Curve's factory.","source":""},{"date":"2025-05","event":"Governance proposal for the new market is published and later passes on-chain.","source":""},{"date":"2025-06","event":"New crvUSD-wstUSR vault deployed; roughly 95 minutes to two hours later an attacker uses a $4,000 flash loan in an ERC-4626 donation attack to borrow 10 million reUSD against 1 wei of collateral, stealing about $9.3–9.8 million. Exploit tx 0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3.","source":"ResupplyFi Hack Analysis — Ackee Blockchain","source_url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"date":"2025-06","event":"Resupply pauses the affected wstUSR market and confirms only that market is impacted.","source":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","source_url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"date":"2025-06","event":"reUSD depegs to about $0.98 and TVL drops from about $135M to $78–85M.","source":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","source_url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"date":"2025-06","event":"Attacker deposits about 1,607 ETH (roughly $6.5M) into Tornado Cash.","source":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","source_url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44"},{"date":"2025-06","event":"C2tP, a Convex developer, commits $1.4 million of personal funds to cover user losses; Convex contributes $810,000 from its treasury.","source":"Resupply developer donates $1.4m after protocol suffers $9m exploit — DL News","source_url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/"},{"date":"2025-06","event":"Criticism grows over the team's three-sentence public response; OneKey founder Yishi Wang criticizes the governance response and discloses over $2M in personal losses.","source":"Post-hack silence, governance failure: deconstructing Resupply's $9.6M — Crypto Labs (Medium)","source_url":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7"},{"date":"2025-06","event":"Curve founder Michael Egorov allegedly threatens legal action against Yishi Wang over his public criticism.","source":"AICoin article on the Resupply governance controversy","source_url":"https://www.aicoin.com/en/article/469162"},{"date":"2025-06","event":"Resupply publishes its recovery proposal: burn 6M reUSD from the insurance pool, repay 1.13M reUSD through future revenue and a Yearn loan, offer 2.5M RSUP as a retention incentive, and hold a shortened three-day vote.","source":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","source_url":"https://www.theblock.co/post/360226/resupply-six-million-burn"},{"date":"2025-07","event":"Governance vote on the recovery plan concludes; the insurance pool burn and withdrawal cooldown proceed after approval.","source":"Resupply protocol outlines recovery plan post $10M exploit, proposes $6M token burn — crypto.news","source_url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/"},{"date":"2025-08","event":"Resupply announces full repayment of the $10 million bad debt, using the insurance pool burn, treasury and developer contributions, and a Yearn loan.","source":"Resupply fully repays $10 million bad debt from June 2025 exploit — AInvest","source_url":"https://www.ainvest.com/news/resupply-fully-repays-10-million-bad-debt-june-2025-exploit-2508/"},{"date":"2025-08","event":"PeckShield-reported laundering of 2,280 ETH (about $9.8M) through Tornado Cash is reported.","source":"ResupplyFi Exploiter Launders $9.8 Million in Stolen ETH Via Tornado Cash","source_url":"https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/"}],"sources_used":[{"url":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232","name":"PIP-46: Shutdown Prisma Finance, introduce Resupply — Prisma governance forum","type":"official","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","name":"Prisma Finance hacker claims $11.6 million whitehat rescue — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260829085419/https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","credibility":3,"archive_timestamp":"2026-08-29T08:54:19+00:00"},{"url":"https://immunebytes.com/blog/prisma-finance-exploit-march-28-2024-detailed-analysis/","name":"Prisma Finance exploit March 28, 2024 — Immunebytes","type":"research","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/prisma-finance-exploited-10-million","name":"Prisma Finance exploited — Cointelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20260829113610/https://cointelegraph.com/news/prisma-finance-exploited-10-million","credibility":3,"archive_timestamp":"2026-08-29T11:36:10+00:00"},{"url":"https://x.com/ConvexFinance/status/1876252394045985148","name":"Convex Finance on X — Resupply announcement","type":"official","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/ConvexFinance/status/1869394912250314810","name":"Convex Finance on X — Resupply introduced","type":"official","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://x.com/ConvexFinance/status/1902702988092735588","name":"Convex Finance on X — Resupply launch","type":"official","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://docs.resupply.fi/resupply-governance/tokenomics","name":"Resupply documentation — Tokenomics","type":"official","archive_url":"http://web.archive.org/web/20260415091142/https://docs.resupply.fi/resupply-governance/tokenomics","credibility":3,"archive_timestamp":"2026-04-15T09:11:42+00:00"},{"url":"https://resupply.finance/","name":"Resupply Official Website","type":"official","archive_url":"http://web.archive.org/web/20260618015645/https://resupply.finance/","credibility":1,"archive_timestamp":"2026-06-18T01:56:45+00:00"},{"url":"https://iq.wiki/wiki/resupply-usd-reusd","name":"Resupply USD (reUSD) — IQ.wiki","type":"other","archive_url":"http://web.archive.org/web/20251118005820/https://iq.wiki/wiki/resupply-usd-reusd","credibility":3,"archive_timestamp":"2025-11-18T00:58:20+00:00"},{"url":"https://iq.wiki/wiki/resupply","name":"Resupply — Projects & Protocols | IQ.wiki","type":"other","archive_url":"http://web.archive.org/web/20251112015133/https://iq.wiki/wiki/resupply","credibility":2,"archive_timestamp":"2025-11-12T01:51:33+00:00"},{"url":"https://outposts.io/article/convex-and-yearn-launch-resupply-protocol-with-yield-bearing-dc94dbfb-4331-49ee-bde9-7c77b71c24cf","name":"Convex and Yearn Launch Resupply Protocol with Yield-Bearing Stablecoin reUSD — Outposts","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","archive_url":"http://web.archive.org/web/20251126141759/https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","credibility":2,"archive_timestamp":"2025-11-26T14:17:59+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","name":"Explained: The Resupply Hack (June 2025) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260802123835/https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","credibility":2,"archive_timestamp":"2026-08-02T12:38:35+00:00"},{"url":"https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply","name":"Hacker Drains $9.6 Million From DeFi Stablecoin Protocol Resupply — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260311041528/https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply","credibility":2,"archive_timestamp":"2026-03-11T04:15:28+00:00"},{"url":"https://www.guardrail.ai/blog/resupplyfi-hack","name":"Lessons from the Resupply exploit — Guardrail","type":"research","archive_url":"http://web.archive.org/web/20260802123835/https://www.guardrail.ai/blog/resupplyfi-hack","credibility":2,"archive_timestamp":"2026-08-02T12:38:35+00:00"},{"url":"https://cryptorank.io/news/feed/0ca5a-hacker-drains-9-6-million-from-resupply","name":"Hacker drains $9.6 million from Resupply — CryptoRank","type":"news_article","archive_url":"http://web.archive.org/web/20260829074858/https://cryptorank.io/news/feed/0ca5a-hacker-drains-9-6-million-from-resupply","credibility":3,"archive_timestamp":"2026-08-29T07:48:58+00:00"},{"url":"https://rekt.news/resupplyfi-rekt","name":"ResupplyFi Rekt — Rekt News","type":"news_article","archive_url":"http://web.archive.org/web/20260328045238/https://rekt.news/resupplyfi-rekt","credibility":2,"archive_timestamp":"2026-03-28T04:52:38+00:00"},{"url":"https://ackee.xyz/blog/resupply-hack-analysis/","name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","archive_url":"http://web.archive.org/web/20250917044636/https://ackee.xyz/blog/resupply-hack-analysis/","credibility":2,"archive_timestamp":"2025-09-17T04:46:36+00:00"},{"url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260703045656/https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","credibility":2,"archive_timestamp":"2026-07-03T04:56:56+00:00"},{"url":"https://www.cryptotimes.io/2025/06/26/hacker-exploits-resupplyfi-bug-to-steal-9-6m-in-crypto/","name":"Hacker Exploits ResupplyFi Bug to Steal $9.6M in Crypto — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20261028164916/https://www.cryptotimes.io/2025/06/26/hacker-exploits-resupplyfi-bug-to-steal-9-6m-in-crypto/","credibility":2,"archive_timestamp":"2026-10-28T16:49:16+00:00"},{"url":"https://cointelegraph.com/news/resupplyfi-defi-exploit-wstusr-96m-loss","name":"ResupplyFi DeFi exploit wstUSR $9.6m loss — Cointelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260331152213/https://cointelegraph.com/news/resupplyfi-defi-exploit-wstusr-96m-loss","credibility":2,"archive_timestamp":"2026-03-31T15:22:13+00:00"},{"url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44","name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","archive_url":"http://web.archive.org/web/20251106020840/https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44","credibility":2,"archive_timestamp":"2025-11-06T02:08:40+00:00"},{"url":"https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/","name":"ResupplyFi Exploiter Launders $9.8 Million in Stolen ETH Via Tornado Cash","type":"news_article","archive_url":"http://web.archive.org/web/20260212042955/https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/","credibility":3,"archive_timestamp":"2026-02-12T04:29:55+00:00"},{"url":"https://cryptopotato.com/stablecoin-protocol-resupply-suffers-9-5m-exploit/","name":"Stablecoin protocol Resupply suffers $9.5M exploit — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260410201736/https://cryptopotato.com/stablecoin-protocol-resupply-suffers-9-5m-exploit/","credibility":3,"archive_timestamp":"2026-04-10T20:17:36+00:00"},{"url":"https://www.coinspeaker.com/resupply-fi-hacked-for-9-6m-who-has-been-affected/","name":"Resupply.fi hacked for $9.6M: who has been affected — Coinspeaker","type":"news_article","archive_url":"http://web.archive.org/web/20260510012552/https://www.coinspeaker.com/resupply-fi-hacked-for-9-6m-who-has-been-affected/","credibility":3,"archive_timestamp":"2026-05-10T01:25:52+00:00"},{"url":"https://nabilech.com/resupplyfi-rekt-how-a-4k-flash-loan-led-to-a-9-8m-erc-4626-donation-attack/","name":"ResupplyFi Rekt: How a $4K Flash Loan Led to a $9.8M ERC-4626 Donation Attack","type":"news_article","archive_url":"https://web.archive.org/web/20260802123821/https://nabilech.com/resupplyfi-rekt-how-a-4k-flash-loan-led-to-a-9-8m-erc-4626-donation-attack/","credibility":3,"archive_timestamp":"2026-08-02T12:38:21+00:00"},{"url":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7","name":"Post-hack silence, governance failure: deconstructing Resupply's $9.6M — Crypto Labs (Medium)","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.aicoin.com/en/article/469162","name":"AICoin article on the Resupply governance controversy","type":"news_article","archive_url":"https://web.archive.org/web/20260829042418/https://www.aicoin.com/en/article/469162","credibility":3,"archive_timestamp":"2026-08-29T04:24:18+00:00"},{"url":"https://www.panewslab.com/en/articles/176r70wk","name":"PANews — Resupply governance controversy","type":"news_article","archive_url":"http://web.archive.org/web/20251111133822/https://www.panewslab.com/en/articles/176r70wk","credibility":3,"archive_timestamp":"2025-11-11T13:38:22+00:00"},{"url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/","name":"Resupply developer donates $1.4m after protocol suffers $9m exploit — DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260617163422/https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/","credibility":2,"archive_timestamp":"2026-06-17T16:34:22+00:00"},{"url":"https://www.theblock.co/post/360226/resupply-six-million-burn","name":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260115122503/https://www.theblock.co/post/360226/resupply-six-million-burn","credibility":2,"archive_timestamp":"2026-01-15T12:25:03+00:00"},{"url":"https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/","name":"Resupply Plans 6M reUSD Token Burn to Recover From $10M Hack — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260802124405/https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/","credibility":2,"archive_timestamp":"2026-08-02T12:44:05+00:00"},{"url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","name":"Resupply protocol outlines recovery plan post $10M exploit, proposes $6M token burn — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20251016214349/https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","credibility":2,"archive_timestamp":"2025-10-16T21:43:49+00:00"},{"url":"https://bitcoinethereumnews.com/tech/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","name":"Resupply protocol outlines recovery plan — BitcoinEthereumNews","type":"news_article","archive_url":"https://web.archive.org/web/20260829024137/https://bitcoinethereumnews.com/tech/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","credibility":3,"archive_timestamp":"2026-08-29T02:41:37+00:00"},{"url":"https://www.ainvest.com/news/resupply-fully-repays-10-million-bad-debt-june-2025-exploit-2508/","name":"Resupply fully repays $10 million bad debt from June 2025 exploit — AInvest","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.binance.com/en/square/post/27733819837209","name":"Binance Square post on Resupply repayment","type":"social_media","archive_url":"https://web.archive.org/web/20260829083419/https://www.binance.com/en/square/post/27733819837209","credibility":3,"archive_timestamp":"2026-08-29T08:34:19+00:00"},{"url":"https://www.coingecko.com/en/coins/resupply-usd","name":"Resupply USD (reUSD) — CoinGecko","type":"other","archive_url":"http://web.archive.org/web/20260619225105/https://www.coingecko.com/en/coins/resupply-usd","credibility":3,"archive_timestamp":"2026-06-19T22:51:05+00:00"},{"url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/","name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","archive_url":"https://web.archive.org/web/20260829120704/https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/","credibility":2,"archive_timestamp":"2026-08-29T12:07:04+00:00"},{"url":"https://auditium.io/resources/resupply/","name":"Resupply audit coverage — Auditium","type":"research","archive_url":"http://web.archive.org/web/20260511185859/https://auditium.io/resources/resupply/","credibility":3,"archive_timestamp":"2026-05-11T18:58:59+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-04T02:54:22.722638+00:00","updated_at":"2026-10-30T20:43:31.209667+00:00"},"source_quality":{"total":40,"tier1":0,"tier2":7,"tier3":3,"unrated":30},"follower_count":null,"content_updated_at":"2026-10-27T19:06:20.019Z","last_fact_checked_at":"2026-10-27T19:06:19.718Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}