Resolv USR Loses Peg After Exploit Allows Minting of 80 Million Tokens

Resolv Labs' USR stablecoin lost its dollar peg after an attacker exploited the protocol's smart contract to mint 80 million tokens, causing a significant supply shock and price collapse according to reports. The attacker leveraged $100,000 in USDC to mint 50 million USR tokens, achieving a 250x return in value, which was rapidly converted into ETH on decentralized exchanges. The incident highlights vulnerabilities in Resolv's smart contract and off-chain infrastructure, raising concerns about protocol security and recovery prospects for the affected stablecoin as detailed.

Resolv Labs' USR stablecoin lost its dollar peg on March 22, 2026, after an attacker exploited the protocol’s smart contract to mint 80 million USR tokens with minimal collateral, extracting approximately $25 million in value and crashing the token's price to as low as $0.025 on decentralized exchanges according to reports. The attacker deposited just $100,000 in USDC and minted 50 million USR, a ratio that should have been impossible under normal contract validation as observed.

The attacker used the minted tokens to swap for USDC and USDt on decentralized exchanges before aggressively converting the proceeds into ETH. D2 Finance, a DeFi analytics firm, identified three possible attack vectors: the oracle was gamed, the off-chain signer was compromised, or amount validation between the mint request and completion was missing entirely according to their analysis. Resolv Labs has not yet published a formal postmortem confirming which vulnerability was exploited as of now.

The flood of 80 million newly minted tokens obliterated USR’s dollar peg within minutes. On Curve Finance’s USR/USDC pool, USR hit a low of $0.025, a 97.5% deviation from its $1 target. The price bottom occurred at 2:38 UTC, just 17 minutes after the initial mint according to data. The token’s market cap collapsed to $26.63 million against a circulating supply of 183.9 million USR as reported.

How Did the Attacker Exploit the System?

The attacker exploited a vulnerability in the protocol by minting an abnormal amount of USR tokens using a minimal deposit. This led to a significant leverage gain, as $100,000 in collateral was used to mint 50 million tokens, translating into $25 million in value extracted according to reports. The attack was facilitated by either a gamed oracle, a compromised off-chain signer, or a missing validation between the mint request and execution as detailed.

Resolv Labs has not yet clarified which exact vulnerability was exploited as of now. This lack of clarity has led to uncertainty about the root cause of the breach and the potential for further exploits according to analysis. The attacker used decentralized exchanges to convert the minted USR tokens into ETH, complicating any potential clawback efforts as observed.

What Was the Financial Impact on the USR Stablecoin?

The financial impact on the USR stablecoin was severe, with its price collapsing from $1 to as low as $0.025 on decentralized exchanges according to reports. The token’s market cap dropped to $26.63 million, reflecting a massive loss of value in a short period as documented. Curve Finance’s USR/USDC pool recorded $3.6 million in 24-hour volume as traders and liquidity providers scrambled to exit positions according to data.

Resolv Labs responded by pausing all protocol functions to prevent further unauthorized minting or fund extraction as reported. The protocol pause means USR holders cannot currently mint or redeem tokens according to their statement. Whether the RLP insurance pool absorbs losses or whether USR holders bear them directly has not been clarified by the team as of now.

The recovery prospects for the USR stablecoin face a significant obstacle: the attacker already converted extracted funds to ETH, making clawback difficult without cooperation from centralized exchanges or bridge operators according to reports. No compensation plan or recovery timeline has been announced as of now.

The incident raises broader concerns about the security of algorithmic and collateral-based stablecoins. USR, an algorithmic stablecoin, relies on protocol-owned liquidity and supply adjustments to maintain its peg. The unauthorized minting of such a large supply directly threatened this peg stability according to analysis.

What Are the Broader Implications for DeFi Security?

The incident underscores the importance of robust private key management and smart contract security in DeFi protocols. The attack exploited either a compromised off-chain signer or a vulnerability in the protocol’s minting validation as detailed. Resolv Labs’ swift response in pausing the smart contract and burning 9 million tokens helped contain the damage, limiting confirmed losses to $500,000 according to reports.

The broader DeFi community must remain vigilant about infrastructure security and smart contract validation. The unauthorized minting of USR tokens highlights how a single vulnerability can have cascading effects on a stablecoin’s peg and market stability as observed. The speed of the depeg, from mint to bottom in under 20 minutes, echoes some of the fastest stablecoin collapses in DeFi history according to data.

Investors and users must assess the risk of holding algorithmic or partially collateral-backed stablecoins. The incident also raises questions about the effectiveness of insurance pools and recovery mechanisms in DeFi protocols as reported.

In summary, the Resolv USR incident serves as a cautionary tale about the fragility of stablecoin pegs and the critical need for comprehensive security audits, transparency, and robust governance in the DeFi ecosystem according to analysis.