Hacker exploits Resupply protocol and steals $9,5 million in stablecoins
- Hacker manipulates stablecoin cvcrvUSD on Resupply protocol
- Exploitation results in theft of $9,5 million in reUSD
- Resupply contract paused after stablecoin attack
The Resupply protocol, which uses liquidity from lending markets to issue its reUSD stablecoin, has suffered an exploit that resulted in losses of approximately $9,5 million. The vulnerability was identified by security analysts as a manipulation in the price of the cvcrvUSD version, a token pegged to Curve USD and deposited with Convex Finance.
On June 26, 2025, the @ResupplyFi experienced a security breach, resulting in a loss of approximately $9.3 million.
The attack was made possible by inflating the share token price of an empty crvUSD Vault through a donation attack, enabling the attacker to borrow $10 million in… pic.twitter.com/Nz8Ouru5ej
— Vladimir S. | Officer's Notes (@officer_cia) June 26, 2025
The vulnerability involved sending fake donations to the cvcrvUSD vault, which artificially inflated the asset’s value. This increase caused Resupply’s smart contract, known as ResupplyPair (CurveLend: crvUSD/wstUSR), to interpret the token as overvalued, affecting exchange rate calculations.
“The hacker exploited the cvcrvUSD vault, allowing the attacker to borrow $10 million in reUSD with just 1 wei worth of stock as collateral,” explained Xuxian Jiang, CEO of security firm PeckShield.
With the price manipulated, the attacker used the lending function in the Resupply contract to secure a massive amount of reUSD with negligible collateral. Analysts at Blocksec reported that the drained funds originated from the wstUSR market, which was directly affected by this action.
After obtaining the reUSD, the attacker converted the tokens into other crypto assets through external markets, securing immediate profit. The Resupply team confirmed the incident, stating that the compromised contract was identified and paused to prevent further losses.
The exploit highlights the risks of DeFi protocols that rely on derived token prices for their lending mechanisms. Cases like this reinforce the importance of continuous auditing of smart contracts, especially in stablecoin projects that rely on secondary markets for liquidity.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Australian Dollar breaks 0.69 as hot US CPI raises 50-bp Fed hike risk
Philadelphia Fed President Paulson supports gradual rate hikes but warns inflation is still “stuck ” above target
Core inflation is "stuck" in the 2.5%-3% range, with triple pressures from tariffs, energy, and AI data center demand. Paulson insists on gradual rate hikes while setting clear trigger conditions—if inflation expectations shift upwards or wage pressures build, he will move more quickly. Meanwhile, Governor Waller stated that if October's core CPI rises 0.3% month-on-month, a 50 basis point rate hike in December should be considered. Dallas Fed's Logan said at least two more rate hikes are needed.
During Anthropic IPO roadshow, OpenAI also discloses financial data: Q3 revenue falls short, losses far exceed expectations
OpenAI's revenue in Q3 reached $10 billion, marking a nearly 50% quarter-on-quarter increase. Its annualized run rate is approximately $50 billion, but operating losses have expanded from $10.1 billion to $10.9 billion. Competitor Anthropic has begun its IPO roadshow, with Q3 revenue of $17 billion and losses of only $567 million, leading in both scale and profitability.
Petrobras (PBR.US) Achieves Record Oil and Gas Production in Q3; Adjusted Net Profit Up 78% Year-on-Year, Raises Full-Year Production and Capital Expenditure Guidance
Petrobras released its Q3 2026 financial results after the US market close on November 10.
Crypto prices
More
