The biggest Curve DAO risk news this week is a governance vote most holders barely noticed. On Sept. 2, 2026, veCRV holders handed the protocol's crvUSD and Llamalend risk mandate to yRisk, a two-person team built from Resupply's core developers. The vote closed a search that started in July, after LlamaRisk exited the role ten months early. The decision matters because yRisk's own bid names its founders as primary resupply developers.