Incident Overview
On March 22, 2026, Resolv Labs suffered an infrastructure breach when attackers gained unauthorized access through a compromised private key and minted approximately $80M in uncollateralized USR tokens. While the attacker currently holds assets valued around $25M, the protocol's actual realized loss is only $0.5M in redemptions processed before contracts were paused. Resolv holds $141M in assets and plans to enable redemptions for all pre-incident USR starting March 23.
This was not a smart contract vulnerability but rather a targeted cyberattack and infrastructure compromise. Attackers gained unauthorized access to Resolv infrastructure through a compromised private key. They used this access to mint approximately $80M worth of uncollateralized USR tokens across multiple transactions, including mints of $50M and $30M. The attacker used 200-300K USDC as initial capital and exploited their unauthorized minting access to create 80M USR tokens. To extract value and bypass liquidity constraints, they staked the minted USR for wstUSR tokens and then swapped these for stablecoins before converting to ETH.
Resolv detected the incident quickly and paused all relevant smart contracts. The protocol managed to burn approximately 9M USR held by the attacker to reduce potential impact. Despite the large nominal amounts, the actual realized damage was minimal. Only $0.5M in redemptions were processed before the pause. The attacker currently holds 11,408 ETH (~$24M) and 20M wstUSR (~$1.3M), but most of this value remains illiquid due to USR's 80% price crash. The protocol's underlying collateral of $141M was not directly compromised.
Resolv is preparing to enable redemptions for all 102M pre-incident USR tokens, starting with allowlisted users on March 23, 2026. Current total USR supply consists of the 102M legitimate pre-incident tokens plus approximately 71M illicitly minted tokens. The team is working with law enforcement and onchain analytics firms to trace the attackers and recover assets.
Exploiter Address: 0x8ed8cf0c…99b81c
Key Transactions:
0xfe37f25e…c33743 ($50M mint)
0x41b6b937…b1f18f ($30M mint)
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Resolv, these are the critical security checks that could have prevented this incident (March 2026).
- Verify all logic paths related to Private Key Compromised / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
- 04
- 05
Learn to Prevent the Next Resolv
The Resolv hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.