- A vulnerability in Resolv Labs’ smart contract allowed an attacker to create up to 80 million unbacked USR tokens.
- The attacker quickly withdrew and converted a significant portion of the funds into Ethereum and stablecoins, causing panic sales.
- USR’s value temporarily plummeted to $0.025 as its peg to the US dollar was lost due to the exploit.
- Resolv Labs paused all protocol functions to prevent further malicious actions and is actively working on recovery efforts.
Stablecoin USR from Resolv Labs Loses USD Peg After $25 Million Hack
In a significant security breach, Resolv Labs’ USR stablecoin was exploited, causing it to lose its peg to the U.S. dollar. The attack exposed vulnerabilities within the project’s smart contract, allowing an attacker to mint a staggering amount of unbacked tokens, leading to substantial financial repercussions.
The Exploit and Immediate Response
On March 22, 2026, Resolv Labs reported an exploit that enabled attackers to mint 50 million unbacked USR tokens. To mitigate further damage, the team promptly paused all protocol functions while working diligently on recovery efforts.
According to blockchain data, the attacker initially deposited approximately $100,000 in USDC before releasing around 50 million USR tokens. Subsequently, analysts from PeckShield noted that the total number of minted tokens reached roughly 80 million.
Massive Token Creation and Fund Withdrawal
The attacker’s cunning strategy involved depositing a relatively small amount of funds into Resolv’s contract via requestSwap and receiving nearly 50 million USR in return. This action facilitated further fund withdrawals as these newly created tokens were quickly distributed across various protocols. There they were exchanged for USDC and USDT before being converted into Ethereum.
Experts from D2 Finance speculated that the issue could have stemmed from a flaw in the asset issuance mechanism. Potential causes included oracle compromise or external transaction confirmation failures.
Panic Sales and Market Impact
In light of this incident, panic sales ensued as traders rushed to offload their holdings. During this turmoil, some transactions occurred at steep discounts, exerting additional downward pressure on USR’s price.
At one point during the crisis, according to DEX Screener data from Curve Finance pools, USR’s price dropped precipitously to $0.025 within minutes of the attack’s commencement. Analysts estimate that attackers managed withdrawals totaling at least $25 million; currently trading around $0.04 per token—a figure significantly below its target level pegged against one U.S Dollar ($1).
Despite February witnessing fewer crypto hacks overall than previous months—this event serves as a stark reminder that DeFi protocols remain highly susceptible targets presenting considerable risks both for users’ funds/liquidity alike alongside broader crypto-market stability concerns moving forward amidst ongoing industry evolution efforts focusing towards enhanced security measures adoption across platforms globally!
