A stablecoin is supposed to be worth one dollar. Resolv’s USR is worth 27 cents and the math to fix it doesn’t work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract around 2:21 UTC on Sunday, creating approximately 80 million uncollateralized tokens over two transactions and extracting approximately $25 million, according to several blockchain security firms and on-chain data.
The attacker then traded the created USR for USDC and USDT on decentralized exchanges, converted the proceeds to ETH, and now holds 11,409 ETH worth approximately $23.7 million plus $1.1 million in USR wrapped in a separate wallet.
USR, a dollar-pegged stablecoin that uses a delta-neutral hedging strategy backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of first minting, according to DEX Screener.
It then returned to around $0.85, but did not re-establish its peg. As of Monday morning, it was trading at $0.27, down 72% for the week.
This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure via a compromised private key, resulting in the creation of approximately $80 million in…
– Resolv Laboratories (@ResolvLabs) March 22, 2026
The root cause was worse than Resolv’s initial statement suggested. The team described the incident as a “compromised private key” and “targeted infrastructure compromise.”
But onchain analysts discovered that the real problem was structural. The SERVICE_ROLE, a privileged account that makes the exchange requests in the minting contract, was controlled by a single external account rather than a multisig. The contract lacked Oracle controls, amount validation, and maximum minting limits.
The attacker deposited 100,000 USDC and received 50 million USR in return, approximately 500 times the expected amount, because nothing in the system checked whether this ratio made sense.
DeFiLlama data shows that Resolv’s TVL peaked at nearly $684 million in February 2025 before declining throughout the year to around $95 million before the exploit.
Resolv said it was working with law enforcement and on-chain analytics companies and would “pursue all available avenues to recover assets.”
The team strongly advised against trading USRs while recovery measures are being implemented, adding that “user actions during the post-exploit period may affect recovery.”
Correction: 6:39 UTC: The previous version incorrectly listed $80 million as a loss in the title and body of the story.
