A stablecoin is meant to be price a greenback. Resolv’s USR is price 27 cents and the maths to repair it would not work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract round 2:21 a.m. UTC on Sunday, creating roughly 80 million unbacked tokens throughout two transactions and extracting roughly $25 million, in keeping with a number of blockchain safety companies and onchain information.
The attacker then swapped the minted USR for USDC and USDT throughout decentralized exchanges, transformed the proceeds to ETH, and now holds 11,409 ETH price about $23.7 million plus $1.1 million in wrapped USR in a separate pockets.
USR, a dollar-pegged stablecoin that makes use of a delta-neutral hedging technique backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool inside 17 minutes of the primary mint, in keeping with DEX Screener.
It later recovered to round $0.85 however has not restored its peg. As of Monday morning it was buying and selling at $0.27, down 72% on the week.
This discover is issued on behalf of Resolv Digital Property Ltd. in relation to the Resolv protocol.
Earlier immediately, a malicious actor gained unauthorized entry to Resolv infrastructure via compromised non-public key, ensuing within the minting of roughly $80M of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The basis trigger was worse than Resolv’s preliminary assertion recommended. The group described the incident as a “compromised non-public key” and “focused infrastructure compromise.”
However onchain analysts discovered the true drawback was structural. The SERVICE_ROLE, a privileged account that completes swap requests within the minting contract, was managed by a single externally owned account fairly than a multisig. The contract lacked oracle checks, quantity validation, and most mint limits.
The attacker deposited 100,000 USDC and obtained 50 million USR in return, roughly 500 instances the anticipated quantity, as a result of nothing within the system checked whether or not that ratio made sense.
DeFiLlama information exhibits Resolv’s TVL peaked close to $684 million in February 2025 earlier than declining via the 12 months to round $95 million earlier than the exploit.
Resolv stated it was working with legislation enforcement and onchain analytics companies and would “pursue all obtainable avenues to get well property.”
The group strongly suggested in opposition to buying and selling USR whereas restoration measures are being carried out, including that “actions of customers throughout post-exploit interval could have an effect on the restoration.”
Correction: 6:39 UTC: The earlier model erroneously talked about $80 million because the loss within the title and story physique
