Curve DAO Appoints yRisk as Provider During Undisclosed Resupply Exploit

Curve DAO officially approved yRisk as risk provider for crvUSD and Llamalend on Sept. 2, following a selection process that began in July.

The mandate grants yRisk 125,000 frxUSD and 568,181 CRV tokens, valued at $250,000. veCRV holders backed the proposal with 536.9 million votes and no votes against, indicating unanimous support.

yRisk replaces LlamaRisk, which departed 10 months into a one-year renewal term. The yRisk entity consists of two contributors who are primary developers for Resupply and are also associated with Yearn.

Resupply suffered a $9.6 million exploit in June 2025 tied directly to code authored by these developers. The yRisk proposal circulated to Curve DAO governance did not disclose this incident, nor did Curve's own comparative review of candidates. This omission means veCRV holders voted without full visibility into security incidents affecting the new provider's associated projects.

Curve DAO officially approved yRisk as risk provider for crvUSD and Llamalend on Sept. 2, following a selection process that began in July.

The mandate grants yRisk 125,000 frxUSD and 568,181 CRV tokens, valued at $250,000. veCRV holders backed the proposal with 536.9 million votes and no votes against, indicating unanimous support.