Resolv's $25M Loss: A Flow Analysis of the 80M USR Mint Attack

The core sequence was a pure flow attack. An attacker used a compromised off-chain key to mint around 80 million USR tokens, worth roughly $80 million at par. The protocol's smart contract, trusting an off-chain service, executed the mint without validating the collateral ratio. This sudden 80M token supply hit DEX pools, causing USR's price to collapse from $1.00 to as low as $0.20.

The broken mechanism was a design flaw in trust. Users deposit USDC and request a mint, but the amount of tokens to be minted is determined by an off-chain service controlled by a single privileged key. The contract itself didn't perform any validation of the price ratio between the deposited token and the minted USR. It only checked that a valid signature existed, making it a blind executor.

This created a direct path from a small deposit to massive token creation. The attacker deposited about $100,000-$200,000 USDC and used the stolen key to authorize two mints of 50M and 30M USR. The protocol's code worked as intended, but the intent was fatally flawed. This allowed the attacker to extract roughly $25 million in ETH by flooding the market with unbacked supply.

The Extraction: From Mint to Ether

The attacker's path was a textbook cash-out. After minting the 80 million USR, they quickly converted it into a staked version, wstUSR. This step likely provided a yield-bearing position and a smoother on-ramp to other protocols. From there, the flow became a direct extraction: the tokens were swapped for other stablecoins and then into Ethereum.

The realized value was substantial and irreversible. Onchain data shows the attacker made off with roughly $23 million in Ether. Another analysis cited a total extraction of roughly $25 million in value. This represents a direct, permanent outflow from the protocol's ecosystem, draining liquidity and confidence.

The speed and scale of the swap confirm a coordinated exit. The attacker moved the illicit tokens through multiple liquidity protocols in batches, prioritizing large sell-offs to minimize slippage. This rapid conversion of unbacked tokens into ETH is the clearest measure of the exploit's financial impact.

The Aftermath: Liquidity, Collateral, and Bad Debt

The attack left Resolv with a severe collateral shortfall. Pre-exploit, the protocol was already under-collateralized, with only $95 million in assets backing about $173 million in USR. That's a collateralization ratio of roughly 55%. The $80 million in uncollateralized tokens minted in the attack turned that precarious position into a full-blown insolvency problem.

The market's verdict is clear and brutal. USR's price has collapsed to around 27 cents, a 73% drop from its peg. This de-peg is not a temporary glitch; it's a broken market reflecting total loss of trust. The protocol's own recovery plan offers a grim consolation: if pre-incident holders redeem first, they may get back roughly 93 cents on the dollar. For everyone else, the value is effectively zero.

The damage extends far beyond Resolv's own balance sheet. The exploit has created a new source of bad debt in DeFi. Protocols that used USR as collateral, like specific Morpho pools, now face the risk of defaults as the underlying asset's value evaporates. This creates a contagion risk, where the failure of one lending market could trigger further liquidations and losses across interconnected protocols.