Stablecoin lending protocol Resupply has suffered a major exploit, losing approximately $9.3 million in what appears to be a targeted attack exploiting a critical bug in its codebase. The incident, which occurred over the weekend, was confirmed by the Resupply team and has sparked fresh concerns over the security standards of decentralised finance (DeFi) platforms.

Blockchain security firm Cyvers revealed that the attacker exploited a price manipulation bug in a pair contract, allowing them to secure a $10 million loan with minimal collateral. The exploit was funded via Tornado Cash, a known crypto privacy mixer often linked with anonymised illicit transactions.

Investor Confidence Hit as Deposits Plunge

Following the incident, Resupply’s total value locked (TVL) dropped sharply from $135 million to $85 million, according to DeFiLlama. The market capitalisation of its native token RSUP also plummeted to just $7 million, reflecting shaken investor confidence.

While Resupply clarified that only the wstUSR market was affected and that the contract has been paused, concerns remain. “The protocol continues to function as intended,” Resupply claimed in a brief statement. However, the exploit has triggered anxiety across the DeFi community, given the sharp drop in user deposits and ongoing market uncertainty.

Resupply’s Relationship with Curve Questioned

Resupply enables users to deposit crvUSD stablecoins into Curve vaults to earn yield, giving it exposure to one of DeFi’s most prominent protocols. However, Curve Finance founder Michael Egorov quickly distanced the project from Resupply, stating, “There is no single person from Curve working on that project.”

“It’s a sad incident because they helped crvUSD to grow a little bit,” Egorov added, hinting at the indirect role Resupply may have played in boosting Curve’s own stablecoin ecosystem.

The hack has reignited debates around the risks of protocols building on top of established DeFi platforms without direct collaboration or oversight.

A Brutal Year for DeFi Exploits

This exploit adds to what has already been a devastating year for DeFi security. According to DeFiLlama, over $2 billion has been lost to hacks and exploits in 2025 alone, a 50% increase from the previous year.

Other high-profile victims include zklend and Conic, both of which were forced to shut down after suffering similar breaches. With each new incident, the pressure mounts on DeFi developers to prioritise security audits, robust testing, and real-time monitoring.

“This exploit could have been prevented with proper input validation, oracle checks, and edge-case testing,” said Cyvers CTO Meir Dolev, underscoring the avoidable nature of the breach.

What’s Next for Resupply?

As of now, Resupply has acknowledged the exploit and promised a full post-mortem once a comprehensive analysis is complete. It remains unclear how the protocol plans to compensate affected users or bolster future defences.

While millions remain locked in Resupply’s unaffected pools, the long-term reputational damage may linger. The exploit is a stark reminder that in the rapidly evolving world of DeFi, innovation must not come at the cost of security and trust.