Curve DAO Risk News: Reappointment of developers after $9.6M bug

Curve DAO Risk Governance News: Voting Results Little Known

The biggest risk governance news for the Curve DAO this week was a vote that most holders paid little attention to. On September 2, 2026, veCRV holders transferred risk management responsibilities for crvUSD and Llamalend in the agreement to yRisk. yRisk is a two-person team of core Resupply developers.

The vote ends a search process that began in July after LlamaRisk withdrew from the role when his term was ten months earlier. The decision was crucial because yRisk's own bid clearly listed its founder as the main Resupply developer. However, Resupply lost $9.6 million due to an attack in June 2025. Neither the proposal itself nor the DAO's internal bidder review mention this history. This constitutes the core controversy point in this Curve DAO risk news.

Zero negative votes, a clear winner

The voting behind this Curve DAO risk governance update is divided into two stages. First, the DAO held nine rounds of non-binding preference voting from August 10 to August 17, one round for each bidder, and holders could support multiple options.

• yRisk: 536.9 million veCRV yes, 0 against, 47 voters, accounting for 68.78% of veCRV supply at the time of snapshot
• CrossWorlds: 401.4 million yes, 236 million against
• Blockworks Advisory, Xerberus, Pharos Watch: Each side has less than 300 million in favor and more than 536 million against

The subsequent binding vote ended at 15:04 UTC on September 2 (Proposition 1492), with 621.1 million veCRVs in favor and only 5.33 against. The proposal was implemented within the next 87 minutes.

How does the agreement pay for new suppliers

This part of the Curve DAO risk news deserves to be broken down separately: How does yRisk get paid?

Component amount details Principal (frxUSD)125,000 frxUSD deposited in sfrxUSD; Proceeds go to the Treasury All Token Stream (CRV)568,181 CRV is worth approximately US$209,500. Attribution structure for 1 year and can be revoked. YRisk original quote is paid in two independent channels 250 per year. The $0,000 approved plan was less than the request: two Resupply developers and an undisclosed attack

Resupply is a stablecoin and lending agreement built on top of crvUSD and CurveLend. In June 2025, attackers used a donation attack to round the exchange rate of one of the vaults to zero, extracting $9.6 million.

This attack did not appear in yRisk's proposal. Auditor Swiss Stake did not directly raise this point, although it noted concerns in its August 3 evaluation that two contributors with existing work may have difficulty covering both scopes, and the surface of their responsibility continues to expand as the new Llamalend market is launched. The same review recommendation starts with limited responsibilities and revises it at public checkpoints to decide whether to expand the scope.

Why did LlamaRisk withdraw early?

This exit is a history that every reader of this Curve DAO Risk News should know. LlamaRisk announced the news on May 29, saying changes in its own participation structure had made its original April 2027 timetable unfeasible. It described the move as a structural adjustment rather than a reflection of its views on the platform.

LlamaRisk ceased active work on June 30 and returned approximately 270,247 unattributed crvUSD to the treasury. Co-founder Michael Egorov opened a new proposal solicitation under his forum account michwill on July 7.

CRV price and market snapshot

As of this Curve DAO risk governance update, according to CoinMarketCap data, CRV trading price is US$0.3687, up 1.74% in the past 24 hours. The market value was US$572.47 million, up 1.86% during the day, and the 24-hour trading volume was US$72.16 million, down 15.37%. This resulted in a volume-to-market value ratio of 12.67%, with a fully diluted valuation of nearly US$1.11 billion. The circulating supply is 1.55 billion CRVs, with the maximum supply of 3.03 billion CRVs distributed among approximately 274,250 holders.

Note: Prices change rapidly and data may not reflect the latest value. Readers should check the real-time price tracker for current data.

Broader Agreement Indicator

DefiLlama data shows that the platform's total lock-in value (TVL) is US$1.355 billion. In the past 30 days, it generated $4.35 million in expenses and $1.3 million in revenue, of which $1.23 million was distributed to CRV holders. Annual incentive spending totaled $37.84 million, while annualized earnings were negative $5.86 million. The 30-day DEX transaction volume reached US$3.45 billion, approximately 315.69 million CRVs (55.14% of the market value) were pledged, and the total active loans were US$45.44 million.

Glossary

• veCRV: Voting trusteeship CRV, used for Curve DAO governance voting.
• crvUSD: Curve's native overcollateralized stablecoin.
• Llamalend: Curve's lending market product, running v1 and v2 versions.
• TVL: Total lock-in value, which is the assets held in the agreement.

Conclusion

Curve's near-unanimous vote shows real trust in yRisk's technical record, but the undisclosed Resupply attack and Swiss Stake's ability warnings mean that trust has not yet been fully tested. The DAO is actually betting on deep protocol experience rather than a clean risk record, and the first limited responsibilities coupled with public checkpoint arrangements will be the key to testing this bet.

Whether yRisk provides stable oversight or repeats the mistake that cost Resupply $9.6 million will shape how Curve selects risk providers in the future.