Discussing the Resupply Security Incident: A DeFi Participant's Perspective

It has been a week since Resupply was attacked. On June 26, a security vulnerability was discovered in the stablecoin market of the DeFi protocol, resulting in a loss of approximately 9.6 million dollars in crypto assets. As an eyewitness, veteran DeFi player 3D has released a series of rights protection videos on his YouTube channel for three consecutive days. We reached out to 3D to hear him share his review and thoughts on this incident.

3D is one of the earlier users involved in Resupply mining, being both a mining player and a content creator. In the interview, he expressed doubts and emotions regarding the current state of the industry, and also mentioned some unspoken rules within the industry. He talked about Curve's "default endorsement", the project's passive response to hacker attacks, and the difficulties the community encounters in the process of defending their rights.

Compared to the loss of money, what is more disappointing for 3D is the shaking of confidence in the industry. He admitted that although he is not the one who suffered the most loss, he is the angriest— not because of money, but because users are ignored and humiliated. His experience reflects the common dilemma faced by many DeFi participants: unclear rights and responsibilities, no avenue for rights protection, and a constant retreat of moral bottom lines.

The following are the main points of the conversation:

The Timeline of the Resupply Theft Incident

The 3D introduction states that the current visible scale of financial losses is approximately 38 million USD, which is the total volume of the insurance pool. He and another user, Yishi, took the lead in defending their rights and became the main voice in the Chinese community.

Regarding the current solution, 3D indicates that users' principal has directly lost 15.5%. The project team has taken out about $2.3 million from team members and the treasury as compensation, which only covers about 20% of the total losses. He believes this approach is merely a "gesture" and cannot compensate for the nearly ten million dollars in losses.

3D questioned why the project party did not try to communicate with the hacker using this money and propose a plan to return the funds in exchange for a white hat reward. He believes that the project party has been extremely passive in recovering the stolen assets, even completely inactive.

There are serious issues with the project's crisis management.

In 3D's view, the Resupply team has serious issues with post-incident handling and completely lacks crisis awareness. They neither publicly addressed the hackers nor issued timely announcements to explain the situation, and they did not initiate any legal or accountability mechanisms. This stands in stark contrast to the standard handling processes of other mature Decentralized Finance protocols.

What is even more frustrating is the project team's arrogant attitude towards the community. When users inquired about the situation on Discord, they directly stated that the losses would be covered by the insurance pool, refusing any room for discussion. In response to users' doubts, they took sarcastic, attacking, and even direct account banning actions.

3D pointed out that the project's approach is to push all responsibility onto the users of the insurance pool, with the aim of keeping the protocol running. Their announcement hardly mentions the amount of loss at all, and this method of information disclosure is very irresponsible.

Worse still, hackers exploited vulnerabilities to mint a large amount of stablecoins at zero cost and sold them off, breaking the original over-collateralization mechanism. However, the project team still did not pause the protocol, resulting in some users successfully withdrawing their funds, while users in the insurance pool were locked due to a 7-day withdrawal delay.

Curve's role in the event has raised questions.

3D believes there is a certain tacit relationship between Resupply and Curve. From a business logic perspective, the design of Resupply is intended to serve Curve, bringing additional volume to its stablecoin. Without the endorsement of Curve, Resupply would find it difficult to attract such a large amount of funding.

However, after the incident, Curve quickly distanced itself, stating that Resupply was just an ecological project unrelated to itself. This huge contrast in attitude before and after the event left many users feeling disappointed. 3D stated that even if a project recommended by a small KOL encounters issues, they will actively follow up and voice their concerns, while Curve's "cutting off" behavior is completely irresponsible.

The Dilemma of DeFi User Rights Protection

3D points out that the biggest difficulty for current DeFi users in protecting their rights lies in unclear responsibilities, coupled with a lack of effective regulation in the industry. For most users, there are almost no effective channels for safeguarding their rights. Once the project party is determined not to take responsibility, users can only rely on themselves to speak out and organize actions.

This situation has left many participants feeling disheartened. 3D candidly stated that although his personal financial loss is not significant, he reacted strongly because he felt insulted. If all project teams maintain this attitude, the entire industry will struggle to survive.

Thoughts on Industry Prospects

The biggest blow this incident dealt to 3D is not the financial loss, but the confidence in the industry. He began to seriously doubt the sustainability of Decentralized Finance; if all projects behave this way, the industry will be unable to continue developing.

3D indicates that they were originally implementing a relatively low-risk strategy, earning 15% after a year of hard work, but now it has vanished in a single day. This situation is difficult for many participants to accept, and some are even considering exiting.

Nevertheless, 3D still hopes to promote industry progress through voicing concerns. He believes that solving problems requires project parties to adhere to ethical standards, while the industry must also establish basic self-regulatory mechanisms. Only in this way can Decentralized Finance rebuild trust and achieve long-term development.