Resupply Hack — June 25, 2025
Overview
In June 2025, Resupply lost $9.6M to a donation attack on a newly deployed, empty vault. Resupply, an on-chain lending protocol, was the victim of an approximately $9.6-$9.8 million hack.
Attack Mechanics
The attacker used a $4K flash loan to donate funds, minted 1 wei of shares, and used it as collateral to borrow the protocol's entire treasury. More specifically, the attacker took advantage of the deployment of a new
crcrvUSD vault to manipulate exchange rates and drain value from the project's smart contracts.Root Cause
The target vault was deployed only two hours before it was exploited, meaning it held negligible value. The vault was empty at deployment, making it vulnerable to price manipulation via donations. By inflating the pool with a donation before minting shares, the attacker tricked the system into assigning an overvalued price to each vault share.
After the Attack
The attacker distributed funds to two addresses. Then, these tokens were sent to Tornado Cash for laundering. The Resupply attacker deposited 1,607 ETH into Tornado Cash, equivalent to approximately $6.5 million.
Sources