An attacker minted 80 million unbacked USR stablecoins on the Resolv protocol early Sunday, extracting roughly $25 million in Ethereum before the team could freeze operations. USR, which is designed to hold a 1:1 peg to the U.S. dollar, crashed to $0.025 on Curve Finance within 17 minutes of the first unauthorized mint.
A stablecoin is a cryptocurrency designed to maintain a fixed value, typically $1, by holding reserve assets or using algorithmic mechanisms to absorb price swings.
- An attacker minted 80 million unbacked USR tokens and extracted approximately $25 million (11,409 ETH) from the Resolv protocol on March 22.
- USR crashed from its $1 peg to $0.025 on Curve Finance within 17 minutes. It was trading near $0.27 by Monday morning, still down 72% on the week.
- The exploit stemmed from a compromised AWS signing key and a minting contract with no maximum issuance limits, no oracle checks, and single-key authorization.
Published: March 23, 2026 UTC
How the exploit worked
The attack targeted Resolv’s minting infrastructure rather than its smart contract logic directly. Minting approvals on the protocol relied on an off-chain service that used a privileged private key to authorize how much USR could be created. The smart contract checked only that a valid signature existed. It did not enforce any cap on the amount.
According to blockchain analytics firm Chainalysis, the attacker compromised Resolv’s AWS Key Management Service (KMS) environment where the signing key was stored. With control over that key, the attacker authorized two minting transactions totaling 80 million USR against less than $200,000 in actual collateral. The first transaction alone produced 50 million USR from a 100,000 USDC deposit, a ratio roughly 500 times what the protocol intended.
The attacker then followed what security researchers described as a “textbook DeFi cash-out path.” They converted USR into wrapped staked USR (wstUSR), swapped that for Circle’s USDC through DeFi liquidity pools, and used the proceeds to buy 11,409 ETH worth approximately $23.7 million. An additional $1.1 million remained in wrapped USR in the attacker’s wallet as of Monday.
Protocol left functionally insolvent
The damage extended well beyond the stolen funds. CoinDesk reported that Resolv held approximately $95 million in protocol assets against $173 million in outstanding liabilities after the attack, leaving the protocol functionally insolvent.
Resolv’s total value locked had already declined from a peak of $684 million in February 2025 to roughly $95 million before the exploit. USR uses a delta-neutral hedging strategy backed by ETH and BTC to maintain its peg, a mechanism that depends entirely on collateral integrity.
Resolv Labs paused all protocol functions after detecting the breach. The team initially described it as a “compromised private key” and “targeted infrastructure compromise,” though subsequent analysis revealed deeper structural design failures. The protocol has burned $9 million in USR to reduce the overhang and said it is working with law enforcement and on-chain analytics firms to trace the stolen funds.
Design flaws raise wider questions
Security researchers pointed to multiple failures that enabled the exploit beyond the key compromise itself. The minting function was controlled by a single externally owned account with no multisignature requirement. There were no oracle price checks to verify whether mint amounts matched collateral deposits. No maximum mint limit existed at the contract level.
“A single point of failure is an attractive target for internal and external threats,” one security researcher noted in a post-mortem analysis. The observation applies broadly across DeFi protocols that rely on privileged keys for core operations without adequate safeguards.
Resolv has announced plans to begin redemptions for legitimate pre-attack USR holders, starting with allowlisted users. The timeline for full recovery remains unclear. KyberSwap and other DeFi platforms have blacklisted the attacker’s wallet addresses to prevent further fund movement.
FAQ
What is the Resolv USR stablecoin?
USR is a dollar-pegged stablecoin issued by Resolv Labs that uses a delta-neutral hedging strategy backed by Ethereum and Bitcoin. The protocol holds long crypto positions offset by short futures contracts to maintain its $1 peg. Before the March 22 exploit, Resolv held roughly $95 million in total value locked.
How much did the Resolv attacker steal?
The attacker extracted approximately $25 million, primarily in the form of 11,409 ETH worth about $23.7 million, plus $1.1 million in wrapped USR tokens. The attacker minted 80 million unbacked USR against less than $200,000 in collateral to execute the theft.
Can Resolv USR holders get their money back?
Resolv Labs has paused protocol operations and announced plans to begin redemptions for legitimate pre-attack USR holders starting with allowlisted users. The protocol burned $9 million in USR to reduce supply, but with $95 million in assets against $173 million in liabilities, full recovery for all holders is not guaranteed.
