USR, a dollar-pegged stablecoin that uses a delta-neutral hedging strategy backed by $ETH and BTC, crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of the first mint, according to DEX Screener.
It later recovered to around $0.85 but has not restored its peg. As of Monday morning it was trading at $0.27, down 72% on the week.
This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol.
Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the minting of approximately $80M of…
— Resolv Labs (@ResolvLabs) March 22, 2026
The root cause was worse than Resolv's initial statement suggested. The team described the incident as a "compromised private key" and "targeted infrastructure compromise."
But onchain analysts found the real problem was structural. The SERVICE_ROLE, a privileged account that completes swap requests in the minting contract, was controlled by a single externally owned account rather than a multisig. The contract lacked oracle checks, amount validation, and maximum mint limits.
The attacker deposited 100,000 $USDC and received 50 million USR in return, roughly 500 times the expected amount, because nothing in the system checked whether that ratio made sense.
DeFiLlama data shows Resolv's TVL peaked near $684 million in February 2025 before declining through the year to around $95 million before the exploit.
Resolv said it was working with law enforcement and onchain analytics firms and would "pursue all available avenues to recover assets."
The team strongly advised against trading USR while recovery measures are being implemented, adding that "actions of users during post-exploit period may affect the recovery."
Correction: 6:39 UTC: The previous version erroneously mentioned $80 million as the loss in the title and story body
coindesk.com
