Curve DAO Risk News: Resupply Devs Picked After $9.6M Exploit
Curve DAO Risk News: A Vote Holders Barely Noticed
The biggest Curve DAO risk news this week is a governance vote most holders barely noticed. On Sept. 2, 2026, veCRV holders handed the protocol's crvUSD and Llamalend risk mandate to yRisk, a two-person team built from Resupply's core developers.
The vote closed a search that started in July, after LlamaRisk exited the role ten months early. The decision matters because yRisk's own bid names its founders as primary resupply developers.
That protocol lost $9.6 million to an exploit in June 2025. Neither the proposal nor the DAO's internal bidder review mentioned that history. It sits at the center of this Curve DAO risk news.
Zero Votes Against, One Clear Winner
The vote behind this Curve DAO risk news update ran in two stages. First, the DAO ran nine non-binding preference votes from Aug. 10 to Aug. 17, one per bidder, and holders could back more than one option.
yRisk: 536,968,660.7 veCRV for, 0 against, 47 voters, 68.78% of veCRV supply at snapshot
CrossWorlds: 401.4 million for, 236 million against
Blockworks Advisory, Xerberus, Pharos Watch: each under 300 million for, versus more than 536 million against
The binding vote came later. Proposal 1492 closed on Sept. 2 at 15:04 UTC, with 621,165,847.95 veCRV in favor and 5.33 against. It executed 87 minutes afterward.
Source: The Defiant Report
How the Protocol Is Paying Its New Provider
This part of the Curve DAO risk news deserves its own breakdown: how is yRisk actually getting paid?
Component | Amount | Detail |
Principal (frxUSD) | 125,000 frxUSD | Held in sfrxUSD; yield returns to the treasury |
Token stream (CRV) | 568,181 CRV | Worth roughly $209,500 |
Vesting structure | 1 year, revocable | Paid as two separate streams |
yRisk's original ask | $250,000 per year | The approved package sits below that request. |
Two Resupply Developers, One Undisclosed Exploit
Resupply is a stablecoin and lending protocol built on crvUSD and CurveLend. In June 2025, an attacker used a donation attack that rounded one vault's exchange rate to zero, draining $9.6 million.
That exploit does not appear anywhere in yRisk's proposal. Reviewer Swiss Stake didn't raise it directly either, though its Aug. 3 assessment flagged a related concern: two contributors with existing jobs may struggle to cover both scopes as new Llamalend markets launch, and the surface they're responsible for keeps growing.
The same review recommended starting with a limited mandate and revisiting it at a public checkpoint before deciding whether to expand.
Why LlamaRisk Walked Away Early
The exit is the backstory every reader of this Curve DAO risk news should know. LlamaRisk announced it on May 29, saying a shift in its own engagement structure made its original April 2027 timeline unworkable. It described the move as structural, not a reflection of its view of the platform.
LlamaRisk stopped active work on June 30 and returned roughly 270,247 unvested crvUSD to the treasury. Founder Michael Egorov opened the new call for proposals on July 7, under his forum handle, michwill.
CRV Price and Market Snapshot
CRV was trading at $0.3687 as of this Curve DAO risk news update, up 1.74% over the past 24 hours, according to CoinMarketCap. Market cap sits at $572.47 million, up 1.86% on the day, against a 24-hour volume of $72.16 million, down 15.37%.
That puts the volume-to-market-cap ratio at 12.67%, with a fully diluted valuation near $1.11 billion. Circulating supply is 1.55 billion CRV out of a 3.03 billion max, spread across roughly 274,250 holders.
Note : Prices can change quickly, so figures may not reflect the latest value. Readers should check a live price tracker for current-data.
Source: CoinMarketCap Chart
Broader Protocol Metrics
DefiLlama data shows the platform holding $1.355 billion in total value locked. It generated $4.35 million in fees and $1.3 million in revenue over the past 30 days, with $1.23 million of that going to CRV holders.
Annual incentive spending totals $37.84 million, against annualized earnings of negative $5.86 million. Thirty-day DEX volume reached $3.45 billion, about $315.69 million of CRV (55.14% of market cap) is staked, and active loans total $45.44 million.
Glossary
veCRV: Vote-escrowed CRV, used for Curve DAO governance voting.
crvUSD: Curve's native overcollateralized stablecoin.
Llamalend: Curve's lending market product, running v1 and v2.
TVL: Total value locked, the assets held in a protocol.
Conclusion
Curve's near-unanimous vote shows real trust in yRisk's technical track record, but the undisclosed Resupply exploit and Swiss Stake's capacity warning mean that trust hasn't been fully tested yet.
The DAO has effectively placed a bet on deep protocol experience over a clean risk record, and the limited first mandate with a public checkpoint is where that bet gets checked.
Whether yRisk delivers steady oversight or repeats the mistake that cost Resupply $9.6 million will shape how Curve handles risk-provider selection going forward.
YMYL Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile; do your own research before making decisions.
