I thought I had everything under control in the Resolv USR exploit, but the damage still exceeded my expectations. Decided to share lessons that almost ruined my DeFi farming portfolio: — 1. Big-name curators won't save you Putting a larger allocation into a vault just because Gauntlet is the curator is a fatal mistake. What happened to Gauntlet's Morpho vaults disappointed me. Their automated rebalancing bots kept supplying USDC into a broken market after the exploit was already known. The systems designed to manage risk were actively making losses worse. Don't trust what they project on their profiles. Verify how they actually manage capital. — 2. Diversifying across black-box vaults is a mistake If the vault you deposit into claims to diversify across yield strategies, depositing into another vault with a similar approach doesn't reduce risk. It concentrates it. wstUSR and RLP were embedded across Morpho vaults, Fluid, Venus Flux, and Euler. When the domino fell, contagion hit 15+ vaults and multiple lending markets because they were all feeding from the same well. In this bear market, there aren't that many opportunities. The underlying positions likely overlap. — 3. When something breaks, check everything immediately I was one of the first to see this exploit unfold. And I just left for the gym, thinking the damage was already done. That was wrong. There was a window where USR was trading at $0.15-$0.40 on DEXs but hadn't been paused on some platforms yet. Opportunistic borrowers exploited that gap to post depegged collateral and drain stablecoins. Had I mapped my full exposure immediately, I could have withdrawn from Venus Flux before they paused withdrawals instead of spending the rest of the day worrying about how operators would fill the hole. When a stablecoin depegs, don't assume the blast radius is contained. Track every integration point. — 4. Crisis response reveals who deserves your trust This incident exposed flaws in protocols I assumed were safe. Venus Flux, for example. I deposited three weeks ago and hadn't tracked what collateral they whitelisted since. But Fluid's team stood out. Facing $15M+ in bad debt and $300M+ in outflows (their worst single day ever), they moved really fast by: > Secured short-term loans to cover 100% of the bad debt > Announced it publicly > Committed to making every user whole All within 24 hours. Can't ask for much more from a team in crisis. However, whitelisting criteria for new collateral assets needs to be much tighter. I got lucky and dodged the worst this time. But the next exploit won't send a warning. Still much more to learn to survive consistently in this market.