Resolv Protocol Hacked for $25M: USR Stablecoin De-Peg Shakes DeFi

The decentralized finance (DeFi) ecosystem was rocked this Sunday by a sophisticated exploit targeting the Resolv protocol. Attackers capitalized on a critical vulnerability to mint a staggering 80 million uncollateralized USR stablecoins at minimal cost. This illicit operation quickly translated into approximately $25 million in real-world assets, causing USR to severely de-peg from the dollar and triggering a cascading effect across various DeFi lending markets.

The Anatomy of an Exploit: 80 Million USR Minted

The audacious attack unfolded around 10:21 AM on March 22. On-chain forensics reveal the perpetrator’s initial move: a deposit of just 100,000 USDC into Resolv’s smart contract. Shockingly, this meager sum allowed the hacker to mint an astounding 50 million USR—a 500-fold increase over the legitimate exchange rate. Emboldened by this success, the attacker swiftly executed a second transaction, conjuring an additional 30 million USR out of thin air.

USR from @ResolvLabs is trading at one cent, someone minted 50m USR with $100k USDChttps://t.co/qc8TLDx7w pic.twitter.com/fXtjZgxzQk

— YAM 🌱 (@yieldsandmore) March 22, 2026

USR, designed as a stablecoin with a 1:1 peg to the US dollar, deviates from traditional fiat-backed models. Its stability is ostensibly maintained through “Delta-neutral hedging strategies” utilizing Ethereum and Bitcoin, aiming to neutralize price volatility via balanced long and short positions. However, this sophisticated mechanism proved insufficient against the exploit.

The market reaction was immediate and brutal. According to DEX Screener data, within a mere 17 minutes of the initial token minting, USR’s price plummeted to $0.025 in the Curve Finance liquidity pool, its deepest market. While a brief recovery saw it touch $0.85, the stablecoin has struggled to regain its crucial $1 peg, highlighting the severe damage inflicted.

Hacker’s Swift Exit and Resolv’s Controversial Response

With the newly minted USR in hand, the attacker (identified by wallet address 0x04A2) moved with remarkable speed. The tokens were rapidly converted into USDC and USDT across various decentralized exchanges (DEXs), then fully consolidated into Ethereum. On-chain records show the hacker’s wallet now holds an impressive 11,409 ETH, valued at approximately $23.7 million.

In the wake of the incident, Resolv Labs released a statement on X (formerly Twitter), asserting that the team had paused all protocol functions. Crucially, they emphasized that the “collateral pool remains fully intact” and “no underlying assets have been lost,” characterizing the event as “purely a USR issuance mechanism vulnerability.”

We are currently investigating a security incident involving unauthorized minting of USR.

At this stage:

The collateral pool remains fully intact. No underlying assets have been lost.

The issue appears isolated to USR issuance mechanics.

Our immediate priority is to:

1)…

— Resolv Labs (@ResolvLabs) March 22, 2026

Security Experts Point to Egregious Lapses

Despite Resolv’s attempts to mitigate the narrative, security experts were quick to challenge the official stance. On-chain data analyst Andrew Hong highlighted a critical flaw: the attack vector stemmed from the “SERVICE_ROLE,” a privileged account responsible for processing exchange requests within the protocol. Alarmingly, this pivotal permission was controlled by a single External Owned Account (EOA), rather than a more secure multi-signature (multisig) setup. Furthermore, the minting contract was found to lack fundamental safeguards, including oracle price verification, quantity checks, and even a predefined minting limit.

DeFi investment fund D2 Finance proposed three potential root causes: malicious oracle manipulation, a compromise of off-chain signers, or a glaring absence of amount validation between minting requests and their execution. YieldsAndMore, who initially brought the incident to light, expressed dismay that a protocol of Resolv’s stature and funding lacked such elementary security protocols for its core management permissions.

Deddy Lavid, CEO of blockchain security firm Cyvers, underscored the broader implications: “This incident exposes the true fragility of stablecoin models. Regular contract audits alone are woefully insufficient. Without real-time, continuous monitoring of token minting and supply, teams are effectively blindfolded and helpless when a crisis like this unfolds.”

The Unseen Scourge: Invisible Inflation and Market Contagion

While Resolv’s claim of an “intact collateral pool” may be technically accurate, it profoundly understates the exploit’s devastating impact. On-chain analysts clarified that this wasn’t a direct treasury drain but rather an insidious “supply inflation” attack. The sudden influx of 80 million newly minted USR instantly diluted the value of all existing tokens. Compounding this, the hacker’s aggressive sell-off directly siphoned liquidity from the pools, leaving legitimate USR holders with assets ruthlessly devalued in an instant.

The fallout quickly metastasized across the broader DeFi lending landscape. With USR and its derivatives widely accepted as collateral on platforms like Morpho and Gauntlet, opportunistic actors seized the moment. They purchased the now-cheap USR on the open market, deposited it onto lending platforms that still valued it at a rigid 1:1 USD peg, and then borrowed substantial amounts of real USDC. This “empty-handed wolf” maneuver effectively drained the liquidity from these lending treasuries, creating a severe contagion risk.

From Darling to Disgrace: Resolv’s Tarnished Legacy

Prior to this catastrophic breach, the Resolv protocol was already experiencing a decline in its total value locked (TVL). USR’s market capitalization had steadily fallen from its peak of $400 million in early February to approximately $100 million just before the exploit.

Headquartered in Abu Dhabi, Resolv was once considered a rising star in the crypto space. In 2025, it successfully closed a $10 million seed funding round, attracting prominent investors including Coinbase Ventures. Adding a layer of bitter irony, Resolv’s official website continues to boast an impressive security resume: 14 rigorous audits conducted by 5 top-tier firms, a generous bug bounty of up to $500,000, and claims of “24/7 uninterrupted smart contract monitoring.” This $25 million lesson, however, stands as a stark and undeniable refutation of these vaunted security defenses, highlighting a critical disconnect between stated security measures and real-world resilience.