Resolv stablecoin hack: 80 million unbacked USR minted and about US$25 million in ether taken
An attacker got Resolv's minting key, created 80 million unbacked USR stablecoins and cashed out about US$25M in ether on 22 March. USR lost its peg. Resolv offers pre-hack holders 1:1 USDC; no recovery of the stolen funds is reported.
Nothing to update on a device. If you held USR, wstUSR or RLP, claim only through Resolv's official portal and ignore unsolicited messages offering to help recover funds. Check Resolv's official channels for the claims deadline.
What’s happening
On 22 March 2026 an attacker gained signing authority over the system that approves new USR stablecoin creation at Resolv, a crypto lending and stablecoin protocol. Using it, they minted 50 million and then 30 million USR with no matching collateral, after depositing only about US$100,000 to US$200,000 in USDC. They swapped the tokens into staked and other stablecoins, then into roughly 11,400 ether worth about US$24.5 million, and USR fell as low as about 20 cents. The tokens' face value was not the amount stolen. Resolv's postmortem says the attack started with a compromised contractor GitHub credential, which led to cloud access and a change to the signing key's permissions; Chainalysis describes the key as held in Amazon's key management service. The smart contract set no maximum mint. Resolv paused its contracts within hours and revoked the credentials. About 46 million USR was later neutralised. Pre-hack holders are being compensated 1:1, with a three-month claims window reported from late May. No recovery of the stolen ether has been reported, and no charges or attribution have been published.
- What
- Breach
- Affects
- Resolv USR stablecoin and Resolv protocol (Ethereum)
- Fixed in
- Nothing to patch
- Since
- 22 Mar 2026
- Closed
- 26 May 2026
Timeline
- UpdateNothing to patch
A recovery plan was reported: USR and wstUSR held before the attack are exchangeable 1:1 for USDC, USR bought after the attack at 1:0.5, and RLP holders expect to recover roughly 60% or more, partly in RESOLV tokens. A three-month claims window opened on the official portal. The page is dated 26 May; its summary says 27 May.
- UpdateNothing to patch
Resolv's postmortem said the attack began with a compromised credential on a contractor's GitHub account, which led to a malicious build workflow, cloud credentials and a change to the signing key's access policy. About 46 million USR had been neutralised by burns and blacklisting; roughly 34 million was unaccounted for. Pre-hack USR holders were being compensated 1:1, and most operations stayed paused.
- UpdateNothing to patch
Press reported about 11,400 ETH (roughly US$24.5 million) extracted, and USR trading at about 26 cents. Resolv paused its app, enabled redemptions and told holders not to trade USR or other Resolv tokens. Chainalysis traced the key to Resolv's AWS key-management setup and reported no recovery of funds.
- UpdateNothing to patch
Resolv sent an onchain message offering the attacker a 10% bounty if the rest, about US$22.5 million in ether, came back within 72 hours. It said it would otherwise work with exchanges, bridges and law enforcement to freeze funds and pursue legal action.
- Made publicNothing to patch
An attacker with signing authority over Resolv's minting process created 50 million unbacked USR, then a further 30 million at 03:41 UTC (80 million in total). They swapped the tokens for ether through hundreds of trades. Resolv paused its contracts at 05:16 UTC and revoked the compromised credentials at 05:30 UTC.
Sources
- Resolv postmortem: March 22, 2026 incidentResolv · 4 Apr 2026
- Lessons from the Resolv hackChainalysis · 24 Mar 2026
- Hacker breaches Resolv DeFi platform, takes $25 millionThe Record · 24 Mar 2026
- Resolv issues 72-hour ultimatum to exploiter for 90% return of $25 million in fundsThe Block · 24 Mar 2026
- Resolv Foundation announces attack recovery plan and launches RWA product line Vault StreetKuCoin News · 26 May 2026