Audit log

Every state-changing event for Resupply: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-27 02:44:48Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,413,716

   sig

   2JRmbJAr6W5v…5edpv7vocopyexplorer ↗

   hash

   AeQKu7hPY6jD…s8WCpvZBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (8577 B) ▸

   {"actor":"system:backfill","investigation_id":"64e2472a-e552-4647-93d9-1fca1269192c","kind":"publish","page_slug":"resupply","published_at":"2026-05-27T02:44:48.426Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Resupply","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","type":"other","url":""},{"credibility":3,"name":"https://immunebytes.com/blog/prisma-finance-exploit-march-28-2024-detailed-analysis/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/prisma-finance-exploited-10-million","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/ConvexFinance/status/1876252394045985148","type":"other","url":""},{"credibility":3,"name":"https://docs.resupply.fi/resupply-governance/tokenomics","type":"other","url":""},{"credibility":3,"name":"https://resupply.finance/","type":"other","url":""},{"credibility":3,"name":"https://iq.wiki/wiki/resupply-usd-reusd","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply","type":"other","url":""},{"credibility":3,"name":"https://www.guardrail.ai/blog/resupplyfi-hack","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/news/feed/0ca5a-hacker-drains-9-6-million-from-resupply","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44","type":"other","url":""},{"credibility":3,"name":"https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/","type":"other","url":""},{"credibility":3,"name":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/stablecoin-protocol-resupply-suffers-9-5m-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.coinspeaker.com/resupply-fi-hacked-for-9-6m-who-has-been-affected/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7","type":"other","url":""},{"credibility":3,"name":"https://www.aicoin.com/en/article/469162","type":"other","url":""},{"credibility":3,"name":"https://www.panewslab.com/en/articles/176r70wk","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/360226/resupply-six-million-burn","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ainvest.com/news/resupply-fully-repays-10-million-bad-debt-june-2025-exploit-2508/","type":"other","url":""},{"credibility":3,"name":"https://www.binance.com/en/square/post/27733819837209","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/resupply-usd","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025","type":"other","url":""},{"credibility":3,"name":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/","type":"other","url":""},{"credibility":3,"name":"https://auditium.io/resources/resupply/","type":"other","url":""},{"credibility":3,"name":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto-labs.medium.com/post-hack-silence-governance-failure-deconstructing-resupplys-9-6m-a338cd9a70b7","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2024/03/29/prisma-finance-hacker-claims-11-6-million-whitehat-rescue/","type":"other","url":""},{"credibility":3,"name":"https://gov.prismafinance.com/t/pip-46-shutdown-prisma-finance-introduce-resupply/232","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/prisma-finance-exploited-10-million","type":"other","url":""}]}],"sources_used":[],"summary":"Resupply (resupply.fi / resupply.finance) is a decentralized stablecoin lending protocol built by contributors from Convex Finance and Yearn Finance, succeeding the hacked Prisma Finance protocol after a March 2024 governance vote. The protocol suffered a critical $9.6 million exploit on June 26, 2025, caused by a donation-attack vulnerability in a newly deployed ERC-4626 vault, with stolen funds laundered through Tornado Cash. The team's post-exploit governance response generated significant community controversy, including alleged silencing of critics and a disputed insurance-pool burn proposal, before the bad debt was eventually fully repaid in August 2025.","timeline":[{"date":"2024-03-28","event":"Prisma Finance (Resupply predecessor) exploited for $11.6 million via MigrateTroveZap contract vulnerability; TVL collapses from $220M to $107M.","source":""},{"date":"2024-12-01","event":"Governance proposal PIP-46 passes, shutting down Prisma Finance and introducing Resupply as successor protocol built on FraxLend codebase by Convex and Yearn contributors.","source":""},{"date":"2025-01-07","event":"Convex Finance officially announces Resupply on X, describing it as a new stablecoin protocol developed jointly by Convex and Yearn.","source":""},{"date":"2025-05-17","event":"Resupply deploys a new LlamaLend Market via Curve's factory.","source":""},{"date":"2025-05-31","event":"Governance proposal for the new market is published and subsequently passes on-chain.","source":""},{"date":"2025-06-26","event":"At 00:18 UTC, crcrvUSD Market 0x6e90 is deployed. At 01:53 UTC (approximately 95 minutes later), attacker executes donation attack using a $4,000 flash loan, draining approximately $9.6 million in reUSD. At 02:53 UTC, protocol pauses the affected market.","source":""},{"date":"2025-06-26","event":"reUSD depegs to approximately $0.98; protocol TVL drops from ~$135M to ~$85M. Resupply confirms breach via X and promises a post-mortem.","source":""},{"date":"2025-06-27","event":"Attacker routes stolen funds through Tornado Cash. Controversy erupts over team's three-sentence public response. OneKey founder Yishi Wang publicly criticizes the governance response and discloses $2M+ personal losses.","source":""},{"date":"2025-06-27","event":"Curve founder Michael Egorov allegedly threatens legal action against Yishi Wang over public criticism. Community backlash intensifies.","source":""},{"date":"2025-06-30","event":"Resupply publishes formal recovery plan: $2.86M treasury repayment already made; proposes 6M reUSD insurance pool burn; 1.13M reUSD to be repaid via future revenue; 2.5M RSUP tokens offered as retention incentive.","source":""},{"date":"2025-08-01","event":"Resupply announces full repayment of all $10 million in bad debt from the June 2025 exploit, using treasury funds, insurance pool, and Convex/Yearn sub-DAO support.","source":""},{"date":"2025-08-12","event":"PeckShield confirms attacker transferred 2,280 ETH (approximately $9.8M) through Tornado Cash, completing money laundering of stolen proceeds.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7b70a5c6-c0f3-4f5c-9223-cde16d55dcb2copy
2. #2reviewby reviewerreviewer

   2026-10-27 19:06:19Z
   Score: 32 → 32 (no score change)
   This review checked a sample of seven claims and the core narrative holds: the June 2025 ERC-4626 donation exploit, the $9.3-9.8M loss range, the audit-scope dispute, the 6M reUSD insurance-pool burn and the August 2025 full repayment all match the sources I could read. Weaknesses are editorial (merge-artifact wording), some unverified details (2.5M RSUP, sreUSD, the Tornado Cash amounts) and compressed sequencing of the Yearn loan. One third-party profile reports a possible June 2026 second attack that is uncorroborated and should be checked.
   anchoranchored

   chain

   ●mainnet-betaslot 462,182,877

   sig

   4A4oyFzbtSMt…WUh8uVQCcopyexplorer ↗

   hash

   DRvCMQBzjFSu…XgWvLtEVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1428 B) ▸

   {"actor":"reviewer","artifact_identity":"f2e33233413f2e6d4298f4af63575825","blocked_count":1,"decided_at":"2026-10-27T19:06:19.446Z","decision":"review","disputed_pct":0,"findings_hash":"Azo32d32NAhJEszEWk8jYTdCevVdJ5ibQfR7pHTM2Kpo","investigation_id":"64e2472a-e552-4647-93d9-1fca1269192c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":32,"omissions":{"material":1,"total":2},"page_content_hash":"9cb3d1a9192906526a753224d005bd104203ce215cc4e0baf651b6a0da76fdda","page_slug":"resupply","prev_score":32,"reason":"This review checked a sample of seven claims and the core narrative holds: the June 2025 ERC-4626 donation exploit, the $9.3-9.8M loss range, the audit-scope dispute, the 6M reUSD insurance-pool burn and the August 2025 full repayment all match the sources I could read. Weaknesses are editorial (merge-artifact wording), some unverified details (2.5M RSUP, sreUSD, the Tornado Cash amounts) and compressed sequencing of the Yearn loan. One third-party profile reports a possible June 2026 second attack that is uncorroborated and should be checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c21a267d-8483-4359-b2ee-a9c9505178fdcopy
3. #3review reviseby judgejudge

   2026-10-27 19:06:19Z
   Score: 32 → 27 (-5)
   The core narrative holds: the June 2025 exploit, the $9.3-9.8 million loss range, the audit-scope dispute, the 6 million reUSD burn and the August 2025 repayment were all supported (claim_findings[0], [5], [3], [2]). The claim-level dispute rate is 0%, but a third-party profile reports a possible further attack in June 2026 that the page does not mention (omission_findings[0], coverage_gaps[0] high priority), and it could not be corroborated either way. The page also contains leftover wording from merged drafts ('one page ... the other') and a compressed Yearn loan sequence (claim_findings[1], [2]). A small penalty and a minor-issues banner apply until the 2026 status is checked and the wording is fixed.
   anchoranchored

   chain

   ●mainnet-betaslot 462,182,883

   sig

   3NKLnkyNRby9…CdjoP7hMcopyexplorer ↗

   hash

   BrwY92XK8Edd…X3EWU6Fqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2006 B) ▸

   {"actor":"judge","artifact_identity":"f2e33233413f2e6d4298f4af63575825","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T19:06:19.446Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"64e2472a-e552-4647-93d9-1fca1269192c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":27,"page_slug":"resupply","prev_score":32,"reason":"The core narrative holds: the June 2025 exploit, the $9.3-9.8 million loss range, the audit-scope dispute, the 6 million reUSD burn and the August 2025 repayment were all supported (claim_findings[0], [5], [3], [2]). The claim-level dispute rate is 0%, but a third-party profile reports a possible further attack in June 2026 that the page does not mention (omission_findings[0], coverage_gaps[0] high priority), and it could not be corroborated either way. The page also contains leftover wording from merged drafts ('one page ... the other') and a compressed Yearn loan sequence (claim_findings[1], [2]). A small penalty and a minor-issues banner apply until the 2026 status is checked and the wording is fixed.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-5,"scored_claims":6,"sequence_num":3,"severity_override":{"applied":true,"band":"minor","from_band":"approve","reason":"The claim percentage is 0% (6 countable findings, none disputed or unverifiable; the one source_blocked finding is excluded), which would normally approve. However the review reports a material omission (a possible second attack in June 2026, single-source and uncorroborated) and a high-priority coverage gap on current protocol status. Neither is resolved, so the page cannot be approved as complete. Escalated only to the minor band because the second incident is unconfirmed and the reviewer found no contradiction with the page."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fdbbb51e-e33b-49cc-afbc-6472af587feecopy