The DeFi protocol ResupplyFi has become the latest target in a string of high-value exploits, suffering a $9.6 million loss due to a price manipulation attack involving its wstUSR lending market. The incident raises serious concerns about the security of synthetic asset mechanisms within decentralized finance.
How the Attack Happened
Blockchain security researchers revealed that the exploit was triggered through a vulnerability in the ResupplyPair smart contract. The attacker artificially inflated the price of cvcrvUSD, a wrapped version of Curve’s stablecoin staked in Convex Finance, by sending high-value token donations. This artificially boosted the share price used by ResupplyFi’s smart contracts.
Using the inflated price, the attacker was able to borrow $10 million reUSD using only 1 wei of cvcrvUSD as collateral.
This manipulation allowed the attacker to drain almost the entire reUSD liquidity pool in one transaction. The funds were then converted to Ether (ETH) and dispersed across multiple wallets.
Immediate Response from ResupplyFi
Following the breach, ResupplyFi confirmed the exploit and stated that the compromised contract was paused to prevent further losses.
“Only the wstUSR market was impacted. A full post-mortem will be released after detailed analysis,” the team said.
The protocol is currently conducting an internal investigation to identify all vulnerabilities and assess the total impact.
Security Concerns in DeFi Protocols
This incident sheds light on the growing security risks in DeFi, especially those using oracle-dependent systems and synthetic stablecoins. According to blockchain security firm Cyvers, the exploit could have been avoided with:
- Proper oracle validation
- Edge-case testing
- Real-time anomaly detection
The attacker used Tornado Cash to fund the wallet and launder the stolen ETH, complicating recovery efforts.
Crypto Hacks in 2025 Exceed $2 Billion
This is part of a larger trend: Over $2.1 billion has been stolen via crypto exploits in 2025 alone, according to on-chain data. The surge includes smart contract bugs, social engineering, and supply chain attacks.
Conclusion
The ResupplyFi $9.6M exploit highlights the urgent need for stronger DeFi security practices. Protocols handling synthetic assets and algorithmic lending must implement oracle safeguards, sanity checks, and continuous auditing to prevent such devastating attacks.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.