Resupply hack — June 2025

Resupply is a DeFi lending protocol that issues the reUSD stablecoin against yield-bearing collateral. On 26 June 2025 at 01:53:59 UTC, roughly 90 minutes after a new crvUSD-wstUSR market went live, an attacker drained it in a single transaction. The incident is widely dated 25 June because of US time zones. BlockSec's analysis sets out the mechanism. The attacker took a 4,000 USDC flash loan, swapped it for crvUSD, donated 2,000 crvUSD to a CurveLend controller that held none, then deposited about 2 crvUSD to mint a single share. One share now appeared to be worth an enormous amount. Resupply's market derived its exchange rate by dividing 1e36 by that reported price; because the price exceeded 1e36, integer division rounded the exchange rate down to zero. A zero exchange rate produced a zero loan-to-value, the solvency check passed, and the attacker borrowed 10,000,000 reUSD. Resupply's post-mortem stresses that the oracle reported the inflated value correctly and that the decisive flaw was the rounding in the exchange-rate calculation, describing it as a targeted attack on the solvency logic rather than a conventional inflation attack. Published figures for the value actually realised differ, because the borrowed reUSD had to be sold: Cyvers told DL News about $9.3 million, most analyses settled on $9.6 million, and Halborn put it at $9.8 million. The protocol's own accounting treats the hole as $10 million of reUSD bad debt. About $2.86 million was repaid from the treasury, a governance proposal burned 6 million reUSD from the insurance pool, and the remaining $1.13 million was carried by the DAO. The proceeds went through Tornado Cash and no arrests have been reported.