Resupply Protocol Suffers $9.6 Million Price Manipulation Exploit

DeFi Protocol Resupply Hit by $9.6 Million Price Manipulation Exploit

Decentralized finance (DeFi) protocol Resupply has fallen victim to a sophisticated price manipulation exploit, resulting in a loss of approximately $9.6 million. The attack, which targeted the protocol's wstUSR market, highlights persistent security vulnerabilities within the DeFi ecosystem, particularly concerning synthetic assets and oracle dependencies.

CyversAlerts

Key Takeaways

The exploit underscores the critical need for robust security measures in DeFi protocols, especially those dealing with synthetic assets and oracle-dependent mechanisms.
Security experts suggest that proper input validation, comprehensive oracle checks, and thorough edge-case testing could have prevented this attack.
Adding sanity checks within lending logic and implementing real-time anomaly monitoring are crucial for mitigating similar risks.
Resupply has confirmed the incident, stating that only the wstUSR market was affected, and the impacted contracts have been paused to prevent further damage. A full post-mortem analysis is expected.

ResupplyFi

The Exploit Unpacked

The attack on Resupply was a classic price manipulation scheme, leveraging a vulnerability in the protocol's exchange rate calculations. Here's a breakdown:

Funding the Attack: The attacker's initial funds were traced back to the cryptocurrency mixer Tornado Cash, a common tool for obscuring transaction origins.
Price Manipulation: The core of the exploit involved artificially inflating the price of the cvcrvUSD (Curve Vault for CurveUSD) token. This was achieved by making targeted "donations" into a low-liquidity market.
Zero Exchange Rate Bug: The manipulated cvcrvUSD price triggered a critical bug in Resupply's ResupplyPair contract, causing the exchange rate to effectively drop to zero. This allowed the attacker to bypass solvency checks.
Massive Borrowing: With the manipulated exchange rate, the attacker was able to borrow nearly $10 million worth of reUSD tokens using minimal collateral (reportedly as little as one wei).
Fund Laundering: After securing the reUSD, the attacker quickly swapped the tokens for USDC and wrapped Ethereum (wETH) via decentralized exchanges like Curve and Uniswap. The stolen funds were then split and moved to two separate addresses, further complicating tracing efforts.

Broader Implications for DeFi Security

This incident is not isolated. The DeFi space has seen billions of dollars lost to hacks and exploits in 2025 alone. This trend highlights several ongoing challenges:

Vulnerability of Synthetic Assets: Protocols relying on synthetic assets and complex oracle systems are particularly susceptible to price manipulation attacks.
Evolving Hacker Tactics: While technical exploits remain prevalent, there's a growing concern about social engineering and insider threats, as seen in other recent incidents.
Importance of Audits and Monitoring: Regular, comprehensive security audits and continuous real-time monitoring are essential for identifying and addressing vulnerabilities before they can be exploited.

The Resupply exploit serves as a stark reminder that despite advancements, the DeFi ecosystem remains a high-risk environment, demanding constant vigilance and innovation in security practices.

Sources

Hacker Exploits ResupplyFi Bug to Steal $9.6M in Crypto, The Crypto Times.
ResupplyFi Exploit Leads to $9.6M Loss in wstUSR Market Amid Price Manipulation Bug, Cointelegraph.
Hacker Drains $9.6 Million From DeFi Stablecoin Protocol Resupply, Decrypt.
Resupply.Fi Hacked for $9.6M, Who Has Been Affected?, Coinspeaker.

This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.