{"id":"resolv-usr-unbacked-mint-theft-mar-2026","category":"breach","status":"closed","title":"Resolv stablecoin hack: 80 million unbacked USR minted and about US$25 million in ether taken","tldr":"An attacker got Resolv's minting key, created 80 million unbacked USR stablecoins and cashed out about US$25M in ether on 22 March. USR lost its peg. Resolv offers pre-hack holders 1:1 USDC; no recovery of the stolen funds is reported.","summary":"On 22 March 2026 an attacker gained signing authority over the system that approves new USR stablecoin creation at Resolv, a crypto lending and stablecoin protocol. Using it, they minted 50 million and then 30 million USR with no matching collateral, after depositing only about US$100,000 to US$200,000 in USDC. They swapped the tokens into staked and other stablecoins, then into roughly 11,400 ether worth about US$24.5 million, and USR fell as low as about 20 cents. The tokens' face value was not the amount stolen. Resolv's postmortem says the attack started with a compromised contractor GitHub credential, which led to cloud access and a change to the signing key's permissions; Chainalysis describes the key as held in Amazon's key management service. The smart contract set no maximum mint. Resolv paused its contracts within hours and revoked the credentials. About 46 million USR was later neutralised. Pre-hack holders are being compensated 1:1, with a three-month claims window reported from late May. No recovery of the stolen ether has been reported, and no charges or attribution have been published.","action":"Nothing to update on a device. If you held USR, wstUSR or RLP, claim only through Resolv's official portal and ignore unsolicited messages offering to help recover funds. Check Resolv's official channels for the claims deadline.","product":"Resolv USR stablecoin and Resolv protocol (Ethereum)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["resolv","usr","stablecoin","crypto-theft","defi","ethereum","key-compromise","depeg"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Resolv postmortem: March 22, 2026 incident","url":"https://resolv.xyz/blog/resolv-postmortem-march-22-2026-incident","by":"Resolv","date":"2026-04-04"},{"kind":"research","title":"Lessons from the Resolv hack","url":"https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/","by":"Chainalysis","date":"2026-03-24"},{"kind":"news","title":"Hacker breaches Resolv DeFi platform, takes $25 million","url":"https://therecord.media/hacker-breaches-resolv-defi-25-million","by":"The Record","date":"2026-03-24"},{"kind":"news","title":"Resolv issues 72-hour ultimatum to exploiter for 90% return of $25 million in funds","url":"https://www.theblock.co/post/394838/resolv-issues-72-hour-ultimatum-to-exploiter-for-90-return-of-25-million-in-funds","by":"The Block","date":"2026-03-24"},{"kind":"news","title":"Resolv Foundation announces attack recovery plan and launches RWA product line Vault Street","url":"https://www.kucoin.com/news/flash/resolv-foundation-announces-attack-recovery-plan-and-launches-rwa-product-line-vault-street","by":"KuCoin News","date":"2026-05-26"}],"started":"2026-03-22","closed":"2026-05-26","created":"2026-11-03T21:25:27.925Z","updated":"2026-11-03T21:25:27.925Z","cve_notes":[],"timeline":[{"at":"2026-05-26","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"A recovery plan was reported: USR and wstUSR held before the attack are exchangeable 1:1 for USDC, USR bought after the attack at 1:0.5, and RLP holders expect to recover roughly 60% or more, partly in RESOLV tokens. A three-month claims window opened on the official portal. The page is dated 26 May; its summary says 27 May.","url":"https://www.kucoin.com/news/flash/resolv-foundation-announces-attack-recovery-plan-and-launches-rwa-product-line-vault-street","by":"KuCoin News","patch":"na"},{"at":"2026-04-04","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Resolv's postmortem said the attack began with a compromised credential on a contractor's GitHub account, which led to a malicious build workflow, cloud credentials and a change to the signing key's access policy. About 46 million USR had been neutralised by burns and blacklisting; roughly 34 million was unaccounted for. Pre-hack USR holders were being compensated 1:1, and most operations stayed paused.","url":"https://resolv.xyz/blog/resolv-postmortem-march-22-2026-incident","by":"Resolv","patch":"na"},{"at":"2026-03-24","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Press reported about 11,400 ETH (roughly US$24.5 million) extracted, and USR trading at about 26 cents. Resolv paused its app, enabled redemptions and told holders not to trade USR or other Resolv tokens. Chainalysis traced the key to Resolv's AWS key-management setup and reported no recovery of funds.","url":"https://therecord.media/hacker-breaches-resolv-defi-25-million","by":"The Record","patch":"na"},{"at":"2026-03-23","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Resolv sent an onchain message offering the attacker a 10% bounty if the rest, about US$22.5 million in ether, came back within 72 hours. It said it would otherwise work with exchanges, bridges and law enforcement to freeze funds and pursue legal action.","url":"https://www.theblock.co/post/394838/resolv-issues-72-hour-ultimatum-to-exploiter-for-90-return-of-25-million-in-funds","by":"The Block","patch":"na"},{"at":"2026-03-22T02:21Z","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"An attacker with signing authority over Resolv's minting process created 50 million unbacked USR, then a further 30 million at 03:41 UTC (80 million in total). They swapped the tokens for ether through hundreds of trades. Resolv paused its contracts at 05:16 UTC and revoked the compromised credentials at 05:30 UTC.","url":"https://resolv.xyz/blog/resolv-postmortem-march-22-2026-incident","by":"Resolv","patch":"na"}],"url":"https://hard.fyi/live/resolv-usr-unbacked-mint-theft-mar-2026/","json":"https://hard.fyi/api/live?id=resolv-usr-unbacked-mint-theft-mar-2026"}