Hacker Resuply laundered 6.5 million USD ETH through Tornado Cash

According to blockchain monitoring data from Paidun, the hacker behind the DeFi Resupply protocol attack in June 2025 transferred 1,607 ETH, worth approximately $6.5 million, into Tornado Cash, a cryptocurrency mixing service. This amount came from a $9.6 million exploit targeting Resupply's wstUSR market, highlighting the existing vulnerabilities in decentralized finance platforms (DeFi).

The attack, first reported by Cryptopolitan on June 26, exploited a vulnerability in Resupply's smart contract, allowing hackers to manipulate token prices and borrow large amounts with minimal collateral. The stolen assets, which were initially converted into stablecoins and ETH through decentralized exchanges like Curve and Uniswap, have now been funneled into Tornado Cash to cover their tracks. This move underscores the persistent challenge of tracking illicit cryptocurrency transactions, as mixing services like Tornado Cash complicate blockchain transparency.

Resupply, a stablecoin protocol integrated with Convex Finance and Yearn Finance, has temporarily suspended the affected wstUSR market to limit further losses. Blockchain security company Cyvers notes that stronger input validation and oracle checks can minimize breaches.