Notional Finance is facing a suspected $1.7 million exploit involving an escrow contract, according to blockchain investigators PeckShield and Specter on Sept. 4. The reported losses include approximately $69,242 in DAI and $1,658,423 in USDC. Specter identified two Ethereum addresses allegedly connected to the movement, labelled as theft addresses, but Notional Finance had not publicly confirmed the incident or its technical cause at the time of reporting.
The suspected attacker reportedly exchanged the stablecoins for 689.2 ETH and deposited the funds into Tornado Cash, complicating tracing and recovery. The two addresses identified by researchers are 0xC954…De69 and 0xDaCC…Ce38. It remains unclear whether the affected assets belonged to users, the protocol treasury, or another party using the escrow contract, and whether the exploit involved a smart-contract vulnerability, compromised credentials, or faulty permissions.
Separately, Curve DAO approved yRisk as its new risk-management provider for crvUSD and Llamalend on Sept. 2. The binding onchain vote passed with approximately 621.2 million veCRV supporting and 5.33 veCRV opposing. yRisk will receive 125,000 frxUSD and 568,181 CRV through two revocable one-year vesting streams, representing an annual budget of roughly $250,000. The proposal was executed about 87 minutes after voting ended.
yRisk contributors Wavey and Dudesahn are identified as core developers at Yearn and Resupply, and as primary developers of Resupply, which suffered a 2025 donation attack with roughly $9.6 million in losses. Curve’s proposal and comparison did not explicitly mention that exploit. Swiss Stake reviewed nine applications and noted capacity as its main concern for the two-person yRisk team. yRisk replaces LlamaRisk, which ended its engagement early and returned about 270,247 crvUSD in unvested funding to Curve’s treasury.
yRisk will review existing risk materials, provide monthly reports, monitor collateral, liquidity, oracle design, concentration and governance risks, and recommend debt ceilings and market parameters. Curve governance and its emergency DAO retain final authority over decisions and execution.
