Resupply DeFi Protocol Suffers $9.6 Million Loss in Security Breach

According to Cointelegraph, decentralized finance (DeFi) protocol Resupply has confirmed a security breach in its wstUSR market, resulting in an estimated $9.6 million in cryptocurrency losses. The breach was reportedly triggered by a price manipulation attack involving the protocol's integration with a synthetic stablecoin known as cvcrvUSD. Blockchain security firm Cyvers identified the exploit, with co-founder and chief technology officer Meir Dolev explaining that the attacker manipulated a price bug in the ResupplyPair contract. This allowed them to borrow $10 million reUSD using minimal collateral. The attacker was allegedly funded through Tornado Cash, and the stolen funds were converted to Ether (ETH) and distributed across two addresses. The incident underscores ongoing security challenges within DeFi protocols, especially those involving synthetic assets and oracle-dependent mechanisms. Dolev suggested that several security measures, such as proper input validation, oracle checks, and edge-case testing, could have prevented the attack. He also recommended that protocols implement sanity checks in lending logic and monitor real-time anomalies to avoid similar breaches. In response to the exploit, Resupply issued a statement acknowledging the incident and confirmed that only its wstUSR market was affected. The company has paused the impacted contracts to prevent further damage and promised to release a full post-mortem analysis once the situation is thoroughly reviewed. This price manipulation exploit on Resupply occurs amid a broader trend of increasing hack losses in the crypto sector, which have reached billions this year. On June 4, crypto security firm CertiK reported that over $2.1 billion had already been stolen through hacks and exploits in 2025. CertiK also noted a shift in hacker tactics towards social engineering. In a related development, smart contract platform Fuzzland recently disclosed that a former employee was responsible for the $2 million Bedrock UniBTC exploit in 2024. The insider reportedly employed social engineering tactics, supply chain attacks, and advanced persistent threat techniques to steal sensitive data used in the exploit.