Resolv Hack

What happened

On 22 March 2026, an attacker minted 80M unbacked USR, Resolv Labs' stablecoin, and turned about $25M of it into ETH. The attacker first reached Resolv's cloud infrastructure through a supply-chain compromise. They then used Resolv's own minting service key to approve two mints worth vastly more than the deposits behind them.

USR fell about 97% on Curve within minutes as the attacker sold through DEXes. Resolv paused its contracts at 05:16 UTC, about three hours after the first mint. It burned or blacklisted about 46M of the illicit USR and compensated pre-exploit USR holders 1:1.

How it happened

1. A Resolv contractor had contributed to a third-party project whose GitHub account was compromised. The attacker used that access to run malicious CI/CD workflows that leaked infrastructure secrets.
2. With those cloud credentials, the attacker changed a key policy and gained signing authority for the SERVICE_ROLE key. That key finalizes USR mint requests.
3. USR minting is a two-step flow. A user deposits collateral on-chain, then the backend key submits how much USR to mint. The contract checked for a valid signature but put no cap on the amount relative to the collateral.
4. At 02:21 UTC and 03:41 UTC, the attacker deposited about $100k USDC in each of two transactions and had 50M and then 30M USR minted.
5. The attacker wrapped USR into wstUSR to reach deeper liquidity, swapped through Curve, Uniswap and aggregators into stablecoins and then ETH, and consolidated about 11,400 ETH. No mixer was used.

Protocol details

Classification Infrastructure / Stablecoin / Frontend & Infrastructure

Protocol Type Basis Trading

Implementation language Solidity

Protocol links Website @ResolvLabs

Market Context at Time of Hack

Token Price at Hack $0.2316

Market Cap at Hack $32.3M

Reported loss / token market cap 77.48%

Token Categories

Decentralized Finance (DeFi) BNB Chain Ecosystem Ethereum Ecosystem Coinbase Ventures Portfolio Stablecoin Issuer Delphi Ventures Portfolio Binance HODLer Airdrops

Protocol Links

GitHub Discord Telegram

Evidence

• report @ResolvLabs incident report x.com
• report Resolv Labs - Rekt rekt.news
• report @ResolvLabs incident report x.com
• report @CertiKAlert incident report x.com
• report @PeckShieldAlert incident report x.com
• report @AMLBotHQ incident report x.com
• report Resolv Postmortem: March 22, 2026 Incident resolv.xyz
• analysis DeFiLlama defillama.com
• analysis Resolv Protocol Incident Analysis certik.com
• analysis resolv.xyz page resolv.xyz resolv.xyz

Understand the attack patterns

Compare incidents →

Access Control Attacks