Incident Summary
A stablecoin is supposed to be worth a dollar. Resolv’s USR is worth 27 cents and the math to fix it doesn’t work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract around 2:21 a.m. UTC on Sunday, creating approximately 80 million unbacked tokens across two transactions and extracting roughly $25 million, according to multiple blockchain security firms and onchain data.
The attacker then swapped the minted USR for USDC and USDT across decentralized exchanges, converted the proceeds to ETH, and now holds 11,409 ETH worth about $23.7 million plus $1.1 million in wrapped USR in a separate wallet.
USR, a dollar-pegged stablecoin that uses a delta-neutral hedging strategy backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of the first mint, according to DEX Screener.
Technical Context
It later recovered to around $0.85 but has not restored its peg. As of Monday morning it was trading at $0.27, down 72% on the week.
This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the minting of approximately $80M of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The root cause was worse than Resolv’s initial statement suggested. The team described the incident as a “compromised private key” and “targeted infrastructure compromise.”
But onchain analysts found the real problem was structural. The SERVICE_ROLE, a privileged account that completes swap requests in the minting contract, was controlled by a single externally owned account rather than a multisig. The contract lacked oracle checks, amount validation, and maximum mint limits.
What To Watch
The attacker deposited 100,000 USDC and received 50 million USR in return, roughly 500 times the expected amount, because nothing in the system checked whether that ratio made sense.
“For most smart contracts, this setup is not unusual,” Ido Sofer, founder at crypto key management firm Sodot, told CoinDesk. “There is a key that has authority over contract specifics – in this case, for minting, that is often overlooked. This single point of failure is an attractive target for internal and external threats.”
“This ties in to a growing trend of attacks that are focusing on the blind spot of security teams – sensitive keys and credentials that do not hold the funds directly, but can be used to access the funds. That includes dev credentials, trading API keys, and other deployment keys,” he added.
DeFiLlama data shows Resolv’s TVL peaked near $684 million in February 2025 before declining through the year to around $95 million before the exploit.Resolv said it was working with law enforcement and onchain analytics firms and would “pursue all available avenues to recover assets.”
The team strongly advised against trading USR while recovery measures are being implemented, adding that “actions of users during post-exploit period may affect the recovery.”
