Resolv Hacked for $25M as USR Stablecoin Crashes to $0.44

Exploit Allowed Minting of 50M Unbacked USR

On March 22, 2026, the Resolv protocol suffered a major security breach. An attacker exploited a vulnerability in the platform's smart contract to mint 50 million USR tokens without any backing. The project's native stablecoin, designed to maintain a $1 peg, plummeted to $0.44.

"Resolv has experienced an exploit that allowed the attackers to mint 50mn of unbacked USR. The team has currently paused all the protocol functions to prevent further malicious actions and is actively working on recovery." — Resolv Labs (@ResolvLabs), original post

The Resolv Labs team immediately paused all protocol functions to prevent further malicious activity and began working on recovery efforts.

Why This Matters

Resolv is a stablecoin issuance platform that offered high yields through delta-neutral strategies built on Ethereum and Bitcoin. This incident raises serious questions about the security of USR's minting mechanism and could erode confidence in similar protocols.

According to Immunefi, the average damage from a single crypto protocol hack is approximately $25 million — excluding the subsequent crash of native tokens. The Resolv attack fits squarely into this pattern, with USR holders suffering additional losses as the token lost more than 55% of its value.

How the Attack Unfolded

Researchers at D2 published a detailed breakdown of the incident. According to their analysis, the attacker deposited 100,000 USDC into the USR Counter contract using the requestSwap function. In return, they received 49.95 million USR — a sum 500 times larger than the deposit.

This outcome was made possible by a flaw in the smart contract. D2 experts suggested several possible explanations: the oracle was deceived, the validator was compromised offline, or there was simply no verification algorithm to check the amount between the requestSwap and completeSwap stages.

How Funds Were Extracted

Once in possession of the tokens, the hacker immediately began liquidating them. They converted USR into wstUSR and initiated mass sell-offs across every available venue. Due to rapidly depleting liquidity, trades executed with significant slippage, further accelerating the USR price collapse.

In the final stage, the attacker moved the proceeds through swaps and cross-chain bridges into other networks. D2 researchers estimated the total damage at approximately $25 million.

The central question posed by D2 analysts: how was a requestSwap for 100,000 USDC authorized as 50 million USR at the completeSwap stage? Someone needs to explain what happened between those two steps, the researchers noted. The Resolv team has not yet provided a detailed explanation.

Current Status

All Resolv protocol functions remain suspended. The project team has stated they are working on mitigating the aftermath and recovering lost funds. No further details have been disclosed by Resolv Labs at this time.