A stablecoin is meant to be value a greenback. Resolv’s USR is value 27 cents and the maths to repair it would not work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract round 2:21 a.m. UTC on Sunday, creating roughly 80 million unbacked tokens throughout two transactions and extracting roughly $25 million, based on a number of blockchain safety companies and onchain knowledge.
The attacker then swapped the minted USR for USDC and USDT throughout decentralized exchanges, transformed the proceeds to ETH, and now holds 11,409 ETH value about $23.7 million plus $1.1 million in wrapped USR in a separate pockets.
USR, a dollar-pegged stablecoin that makes use of a delta-neutral hedging technique backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool inside 17 minutes of the primary mint, based on DEX Screener.
It later recovered to round $0.85 however has not restored its peg. As of Monday morning it was buying and selling at $0.27, down 72% on the week.
This discover is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier immediately, a malicious actor gained unauthorized entry to Resolv infrastructure by compromised non-public key, ensuing in the minting of roughly $80M of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The root trigger was worse than Resolv’s preliminary assertion advised. The crew described the incident as a “compromised private key” and “targeted infrastructure compromise.”
But onchain analysts discovered the actual drawback was structural. The SERVICE_ROLE, a privileged account that completes swap requests in the minting contract, was managed by a single externally owned account somewhat than a multisig. The contract lacked oracle checks, quantity validation, and most mint limits.
The attacker deposited 100,000 USDC and acquired 50 million USR in return, roughly 500 occasions the anticipated quantity, as a result of nothing in the system checked whether or not that ratio made sense.
DeFiLlama knowledge exhibits Resolv’s TVL peaked close to $684 million in February 2025 earlier than declining by the 12 months to round $95 million earlier than the exploit.
Resolv stated it was working with regulation enforcement and onchain analytics companies and would “pursue all available avenues to recover assets.”
The crew strongly suggested in opposition to buying and selling USR whereas restoration measures are being applied, including that “actions of users during post-exploit period may affect the recovery.”
Correction: 6:39 UTC: The earlier model erroneously talked about $80 million as the loss in the title and story physique
