Resolv Labs‘ stablecoin USR has lost its dollar peg and fallen more than 74% in value after an attacker exploited the protocol to mint approximately $80 million worth of uncollateralized tokens. The platform confirmed the breach in a public statement, attributing it to a compromised private key that granted unauthorized access to Resolv infrastructure. Blockchain forensics firm Chainalysis subsequently published a post-mortem detailing how the attack unfolded.
According to Chainalysis, the attacker converted the newly minted, unbacked USR into a staked variant called wstUSR before swapping those holdings into other stablecoins and then into Ethereum. The entire cash-out sequence was described by crypto fund D2 Finance as a “textbook DeFi hacking cash-out path,” with the attacker dispatching USR in batches to multiple liquidity protocols while prioritizing large sell-offs. In total, roughly $25 million in value was extracted before the exploit was contained.
Chainalysis noted that the attack was made possible because minting approvals depended on an off-chain service that used a privileged private key to authorize how much USR could be created. Critically, the underlying smart contract imposed no maximum limit on USR minting, leaving the system exposed once that key was compromised. Data platform RootData separately suggested the method may have involved manipulated oracles, leaked off-chain signer keys, or other vulnerabilities in the minting mechanism.
Price data from CoinGecko showed USR plunging more than 74% following the exploit as the attacker moved to liquidate the illegally created tokens. Resolv Labs responded by pausing all protocol functions to limit further damage. The company also stated that approximately $9 million in USR had been burned in an effort to reduce the potential impact of the outstanding unbacked supply.
Resolv Labs said it is cooperating with law enforcement and on-chain analytics firms to identify those responsible and to contain the illicitly minted tokens still in circulation. The platform is also preparing to enable redemptions for what it termed “pre-incident USR,” beginning with allowlisted users. No timeline for a full resumption of services has been announced.
The incident adds to a growing list of security failures across decentralized finance in recent months. Step Finance, a protocol built on Solana, announced plans to wind down just weeks after suffering a $29 million hack. Separately, a oracle error left DeFi lender Moonwell carrying $1.8 million in bad debt. The Resolv exploit underscores persistent concerns about the security of off-chain signing mechanisms and the absence of on-chain safeguards in DeFi minting systems.
Originally reported by Decrypt.
