A stablecoin is supposed to be worth one dollar. Resolv’s USR is worth 27 cents and the math to fix it doesn’t work.
An attacker exploited a flaw in Resolv’s USR stablecoin minting contract around 2:21 UTC Sunday, creating approximately 80 million unbacked tokens across two transactions and extracting about $25 million, according to multiple blockchain security firms and onchain data.
The attacker then exchanged the minted USR for USDC and USDT across decentralized exchanges, converted the proceeds to ETH, and now has 11,409 ETH worth about $23.7 million plus $1.1 million in packaged USR in a separate wallet.
USR, a dollar-pegged stablecoin that uses a delta-neutral hedging strategy backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of the first coin, according to DEX Screener.
It later recovered to around $0.85 but has not recovered its peak. On Monday morning it was trading at $0.27, down 72% on the week.
This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the expropriation of approximately 80 million. USD of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The root cause was worse than Resolv’s original statement suggested. The team described the incident as a “compromised private key” and “targeted infrastructure compromise.”
But onchain analysts found that the real problem was structural. SERVICE_ROLE, a privileged account that completes exchange requests in the mint contract, was controlled by a single externally owned account instead of a multisig. The contract lacked oracle checks, amount validation and maximum coin limits.
The attacker deposited 100,000 USDC and received 50 million USR in return, approximately 500 times the expected amount, because nothing in the system checked whether that ratio made sense.
DeFiLlama data shows that Resolv’s TVL peaked near $684 million in February 2025 before falling through the year to around $95 million before the exercise.
Resolv said it was working with law enforcement and onchain analytics firms and would “pursue all available avenues to recover assets.”
The team strongly advises against trading USR while recovery measures are implemented, adding that “user actions in the post-exploitation period may affect recovery.”
Correction: 6:39 UTC: The earlier version incorrectly listed $80 million as the loss in the title and story
