Curve DAO chooses yRisk as risk assessor despite $9.6 million hack

Curve DAO approved yRisk as the new risk assessor for crvUSD and Llamalend on 2 September. The appointment follows the early departure of predecessor LlamaRisk, which stopped 10 months into a one-year extension. Notably, the two people behind yRisk are also core developers of Resupply, a protocol that was hit by an attack in June 2025 in which $9.6 million was lost. That information is missing from the approved proposal.

In brief:

• Curve DAO approves yRisk as risk assessor for crvUSD and Llamalend, replacing LlamaRisk.
• yRisk receives 125,000 frxUSD and 568,181 CRV through revocable one-year vesting streams.
• The two yRisk developers are also involved with Resupply, which was hacked for $9.6 million in June 2025; this is not stated in the proposal.

yRisk replaces LlamaRisk after selection process that began in July

The selection process for a new risk assessor had been running since July, after LlamaRisk decided to end its assignment earlier than agreed. Curve DAO ultimately chose yRisk, a two-person team that describes itself in the proposal as “primary Resupply developers” and “core developers at Yearn and Resupply, through their respective companies”.

The vote was one-sided: yRisk received approximately 536.9 million veCRV votes in favour and none against. As compensation, the duo receives 125,000 frxUSD and 568,181 CRV through revocable one-year vesting streams.

Resupply hack not mentioned in the proposal

Resupply is a stablecoin and lending protocol built on top of crvUSD and CurveLend. In June 2025, the protocol was hit by a so-called donation attack, in which an attacker rounded a vault’s exchange rate down to zero and managed to withdraw $9.6 million.

yRisk did not mention that exploit in the proposal on which Curve DAO voted, and Curve’s own comparative overview of candidates also made no mention of it. Critics point out that a risk assessor in particular should offer full transparency about previous security incidents at projects involving its staff.