Resolv Labs said a Sunday security incident let attackers mint 50 million unbacked USR through a contract exploit, hitting the stablecoin’s peg within minutes. The team said the issue was limited to the token issuance system rather than the collateral pool itself. Protocol functions were paused right away, and the project has started investigation and recovery work.
Minting flaw turned 100,000 USDC into 50 million USR
The exploit focused on USR’s minting logic. Onchain investigator Ai9684xtpa said 100,000 USDC was used to generate 50 million USR, implying an abnormal 500x expansion in output. Security firm PeckShield also said attackers minted another 30 million USR. Resolv Labs, though, maintained that the backing pool was not drained and that underlying collateral remained intact.
D2 Finance pointed to several possible explanations, including oracle manipulation, compromised offchain signing, or missing validation checks. No final cause has been confirmed by Resolv so far. The protocol remains paused while the team reviews the exploit path and broader system weaknesses.
Fast swaps across pools intensified the depeg
After minting the tokens, the attackers moved quickly across protocols. D2 Finance said the newly created USR was swapped into USDC and USDT, then converted into Ether. That sequence pushed heavy selling pressure into liquidity pools. It happened fast, and the market had little room to absorb it.
USR broke from its dollar peg in minutes and fell to $0.257, a drop of 74.2%. In some pools, slippage and strained liquidity drove the price down to as low as $0.025. The report said that low was reached just 17 minutes after the initial mint event. Curve Finance, the token’s most active market, saw intense trading during that stretch.
Protocol stays paused as estimated losses near $25 million
Resolv Labs said containment and impact assessment are the immediate priorities, with user protection also part of the response. The team repeated that no assets were lost from the collateral pool, but recovery efforts are still in progress. There is no stated timeline yet for resuming normal protocol operations.
USR has since recovered part of the move and was recently trading near $0.86, still below its intended $1 peg. D2 Finance estimated that attackers extracted about $25 million during the incident. The breach came after a decline in crypto exploits earlier in February, showing that smart contract risk remains active even as attack frequency shifts.