Resupply Protocol Fights Back: $6M Token Burn Plan Unveiled After $10M Exploit

DeFi's resilience gets a stress test as Resupply Protocol takes drastic action.

After bleeding $10M in a brutal exploit, the team isn't just patching holes—they're torching supply. The proposed $6M token burn screams 'scorched earth' to regain trust.

Because nothing says 'we're serious about security' like watching millions vanish twice—first from hackers, then from circulation. Traders love a good pyrotechnics show, especially when it conveniently reduces sell pressure.

How the Resupply exploit happened

According to the protocol’s post-mortem report, the attacker exploited a vulnerability in the crvUSD-wstUSR market. The exploit was made possible because the underlying CurveLend vault had no prior deposits, allowing the attacker to manipulate how the share value was calculated.

By donating a large amount of crvUSD to the vault and minting just 1 wei of shares, the attacker artificially inflated prices to make the collateral appear more valuable than the actual deposit.

While the oracle correctly reported the inflated value, a rounding issue in the contract’s exchange rate calculation caused the value to resolve to zero. This zero value broke the protocol’s solvency check, making every loan request appear safe. With the bypass, the attacker was able to borrow up to the pair’s full $10 million reUSD debt limit. 

Resupply stressed that the scheme was not a typical inflation attack, but a more targeted and sophisticated design aimed at nullifying the solvency logic.

“The exploit FLOW involved inflation of the CurveLend collateral shares, but differed from a classical ‘inflation attack’ as it was carefully designed to nullify a borrower solvency check,” Resupply stated.

The team added that the stolen funds remain on-chain and are actively being monitored. Furthermore, stronger security measures will be deployed going forward to permanently defend against similar exploits.