Resolv Labs’ USR stablecoin lost its dollar peg on March 22, 2026, after an attacker exploited the protocol’s smart contract to mint 80 million USR tokens with minimal collateral, extracting approximately $25 million and crashing the token to as low as $0.025 on decentralized exchanges.
How the Attacker Exploited Resolv Labs to Mint 80 Million USR
The attacker deposited just $100,000 in USDC and minted 50 million USR, a ratio that should have been impossible under normal contract validation. Blockchain security firm PeckShield confirmed a second minting batch of 30 million USR, bringing the total to 80 million unauthorized tokens.
The effective leverage was staggering: roughly 250x, turning $100,000 in deposited collateral into $25 million in extracted value. The attacker swapped the minted USR for USDC and USDt on decentralized exchanges, then aggressively converted the proceeds into ETH.
D2 Finance, a DeFi analytics firm, identified three possible attack vectors: the oracle was gamed, the off-chain signer was compromised, or amount validation between the mint request and completion was missing entirely. Resolv Labs has not yet published a formal postmortem confirming which vulnerability was exploited.
“Either the oracle was gamed, the off-chain signer was compromised, or the amount validation between request and completion is simply missing.”
D2 Finance
No confirmed transaction hashes have been published by Resolv Labs or auditing firms as of press time. The absence of an official incident report leaves the exact exploit mechanism unconfirmed, though the on-chain minting activity has been independently verified by PeckShield.
USR Crashed 97.5% as Supply Shock Hit Liquidity Pools
The flood of 80 million newly minted tokens obliterated USR’s dollar peg within minutes. On Curve Finance’s USR/USDC pool, USR hit a low of $0.025, a 97.5% deviation from its $1 target. The price bottom occurred at 2:38 UTC, just 17 minutes after the initial mint.
USR set a new all-time low of $0.1419 on CoinGecko, and at press time was trading around $0.1456, still down roughly 85% from its peg. The token’s market cap collapsed to $26.63 million against a circulating supply of 183.9 million USR.
Curve Finance’s USR/USDC pool recorded $3.6 million in 24-hour volume as traders and liquidity providers scrambled to exit positions. The speed of the depeg, from mint to bottom in under 20 minutes, echoes some of the fastest stablecoin collapses in DeFi history, though the mechanism differs from algorithmic failures like the broader stablecoin market shifts seen in recent months.
The broader crypto market was already under pressure, with the Fear and Greed Index sitting at 10, deep in “Extreme Fear” territory. Community sentiment toward USR turned sharply negative, with CoinGecko showing 75% negative votes on the token’s page.
Resolv Labs Pauses Protocol as Recovery Remains Uncertain
Resolv Labs acknowledged the exploit on X and took immediate action, pausing all protocol functions to prevent further unauthorized minting or fund extraction.
“The team has currently paused all the protocol functions to prevent further malicious actions and is actively working on recovery.”
Resolv Labs, via X
The protocol pause means USR holders cannot currently mint or redeem tokens. Whether the RLP insurance pool absorbs losses or whether USR holders bear them directly has not been clarified by the team.
Recovery prospects face a significant obstacle: the attacker already converted extracted funds to ETH, making clawback difficult without cooperation from centralized exchanges or bridge operators. No compensation plan or recovery timeline has been announced.
The exploit adds to growing scrutiny of on-chain stablecoin minting controls. Regulatory bodies including the SEC and EU’s MiCA framework have flagged undercollateralized stablecoin risks, and a $25 million exploit of this nature may intensify calls for stricter smart contract audit requirements.
USR holders should treat the token as high-risk until Resolv Labs publishes a full postmortem and outlines a concrete recovery plan. With the protocol paused and the attacker’s funds already converted, the path back to a $1 peg remains unclear.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
