A stablecoin is meant to be price a greenback. Resolv’s USR is price 27 cents and the maths to repair it does not work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract round 2:21 a.m. UTC on Sunday, creating roughly 80 million unbacked tokens throughout two transactions and extracting roughly $25 million, in response to a number of blockchain safety companies and onchain knowledge.
The attacker then swapped the minted USR for USDC and USDT throughout decentralized exchanges, transformed the proceeds to ETH, and now holds 11,409 ETH price about $23.7 million plus $1.1 million in wrapped USR in a separate pockets.
USR, a dollar-pegged stablecoin that makes use of a delta-neutral hedging technique backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool inside 17 minutes of the primary mint, in response to DEX Screener.
It later recovered to round $0.85 however has not restored its peg. As of Monday morning it was buying and selling at $0.27, down 72% on the week.
This discover is issued on behalf of Resolv Digital Belongings Ltd. in relation to the Resolv protocol.
Earlier as we speak, a malicious actor gained unauthorized entry to Resolv infrastructure by means of compromised non-public key, ensuing within the minting of roughly $80M of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The foundation trigger was worse than Resolv’s preliminary assertion advised. The workforce described the incident as a “compromised non-public key” and “focused infrastructure compromise.”
However onchain analysts discovered the true drawback was structural. The SERVICE_ROLE, a privileged account that completes swap requests within the minting contract, was managed by a single externally owned account moderately than a multisig. The contract lacked oracle checks, quantity validation, and most mint limits.
The attacker deposited 100,000 USDC and obtained 50 million USR in return, roughly 500 occasions the anticipated quantity, as a result of nothing within the system checked whether or not that ratio made sense.
DeFiLlama knowledge reveals Resolv’s TVL peaked close to $684 million in February 2025 earlier than declining by means of the 12 months to round $95 million earlier than the exploit.
Resolv mentioned it was working with legislation enforcement and onchain analytics companies and would “pursue all out there avenues to recuperate property.”
The workforce strongly suggested in opposition to buying and selling USR whereas restoration measures are being carried out, including that “actions of customers throughout post-exploit interval could have an effect on the restoration.”
Correction: 6:39 UTC: The earlier model erroneously talked about $80 million because the loss within the title and story physique