A stablecoin is supposed to be worth a dollar. Resolv's USR is worth 27 cents — and the math to fix it doesn't work.
An attacker exploited a flaw in Resolv's USR minting contract around 2:21 a.m. UTC on Sunday, creating roughly 80 million unbacked tokens across two transactions and extracting about $25 million, according to multiple blockchain security firms and onchain data.
How the attacker pulled it off
The attacker deposited 100,000 USDC and received 50 million USR — roughly 500 times the expected amount. The system had no check on whether that ratio made sense. The minted USR was then swapped for USDC and USDT across decentralized exchanges, and the proceeds converted to ETH. A separate wallet now holds 11,409 ETH (worth about $23.7 million) plus $1.1 million in wrapped USR.
USR crashed to $0.025 on its most liquid Curve Finance pool within 17 minutes of the first mint, according to DEX Screener. It later recovered to around $0.85 but never regained the peg. By Monday morning it was trading at $0.27, down 72% on the week.
Root cause: centralized privilege and missing checks
Resolv initially described the incident as a "compromised private key" and "targeted infrastructure compromise." However, onchain analysts found the real problem was structural: the SERVICE_ROLE — a privileged account that completes swap requests in the minting contract — was controlled by a single externally owned account (EOA), not a multisig. The contract lacked oracle checks, amount validation, and maximum mint limits.
"For most smart contracts, this setup is not unusual," said Ido Sofer, founder of crypto key management firm Sodot. "There is a key that has authority over contract specifics — in this case, for minting. This single point of failure is an attractive target." He added that this ties into a growing trend of attacks targeting blind spots: sensitive keys and credentials that don't hold funds directly but can access them, including dev credentials, trading API keys, and deployment keys.
DeFiLlama data shows Resolv's total value locked peaked near $684 million in February 2025, then declined to roughly $95 million before the exploit. Resolv said it was working with law enforcement and onchain analytics firms and would pursue all available avenues to recover assets.