A stablecoin is supposed to be worth a dollar. Resolv's USR is worth 27 cents and the math to fix it doesn't work.
An attacker exploited a flaw in Resolv's USR stablecoin minting contract around 2:21 a.m. UTC on Sunday, creating approximately 80 million unbacked tokens across two transactions and extracting roughly $25 million, according to multiple blockchain security firms and onchain data.
The attacker then swapped the minted USR for USDC and USDT across decentralized exchanges, converted the proceeds to ETH, and now holds 11,409 ETH worth about $23.7 million plus $1.1 million in wrapped USR in a separate wallet.
USR, a dollar-pegged stablecoin that uses a delta-neutral hedging strategy backed by ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of the first mint, according to DEX Screener.
It later recovered to around $0.85 but has not restored its peg. As of Monday morning it was trading at $0.27, down 72% on the week.
The root cause was worse than Resolv's initial statement suggested. The team described the incident as a "compromised private key" and "targeted infrastructure compromise."
But onchain analysts found the real problem was structural. The SERVICE_ROLE, a privileged account that completes swap requests in the minting contract, was controlled by a single externally owned account rather than a multisig. The contract lacked oracle checks, amount validation, and maximum mint limits.
The attacker deposited 100,000 USDC and received 50 million USR in return, roughly 500 times the expected amount, because nothing in the system checked whether that ratio made sense.
DeFiLlama data shows Resolv's TVL peaked near $684 million in February 2025 before declining through the year to around $95 million before the exploit.
Resolv said it was working with law enforcement and onchain analytics firms and would "pursue all available avenues to recover assets."
The team strongly advised against trading USR while recovery measures are being implemented, adding that "actions of users during post-exploit period may affect the recovery."
Correction: 6:39 UTC: The previous version erroneously mentioned $80 million as the loss in the title and story body
