On June 25, 2025, Resupply's newly-deployed (2 hours old) crcrvUSD vault on Ethereum was exploited. Attacker performed ERC4626 donation attack, minting 1 wei shares against 2,000 crvUSD, then deposited 1 wei collateral to borrow entire $9.6M vault through exchange rate rounding.

According to monitoring by the MistEye system, decentralized stablecoin protocol Resupply appears to have suffered an exploit, with estimated losses of around $9.5 million. The attacker manipulated the cvcrvUSD exchange rate by making donation transactions to the cvcrvUSD Controller contract, ultimately stealing a large amount of reUSD tokens.