Hackers exploited a vulnerability in the Resupply DeFi protocol in June 2025, stealing 1,607 ETH valued at approximately $6.5 million. The funds were laundered through Tornado Cash, following a $9.6 million exploit of the Resupply wstUSR market. The attackers manipulated token prices to borrow large sums with minimal collateral, converting the stolen assets to stablecoins and ETH via Curve and Uniswap before obscuring their trail through Tornado Cash. Resupply, integrated with Convex Finance and Yearn Finance, paused the affected market to prevent further losses. Cyvers, a blockchain security firm, indicated that better input validation and oracle checks could have mitigated the exploit.