Resolv Labs' USR Stablecoin Experiences Major Depeg After $80 Million Minting Exploit

The exploit highlights vulnerabilities in decentralized finance (DeFi) protocols, raising concerns about the stability of yield-bearing stablecoins.

• USR stablecoin depegged on March 22, 2026, after an attacker minted 80 million unbacked tokens using a compromised private key.
• Resolv Labs paused operations and initiated recovery measures, including token burns and redemptions for pre-incident holders.
• Market response saw USR plunge to $0.025 before partially stabilizing around $0.27, while the attacker extracted approximately $25 million in ETH.

• Resolv Labs, based in Abu Dhabi, developed USR as a yield-bearing stablecoin backed by over-collateralized assets, with a peak total value locked of $684 million in February 2025.
• The exploit occurred due to a lack of mint limits and validations in the minting mechanism, allowing the attacker to leverage SERVICE_ROLE privileges.
• Post-incident, Resolv Labs confirmed $141 million in collateral remained intact, but the protocol faces functional insolvency due to inflated supply and liabilities.

On March 22, 2026, at approximately 2:21 a.m. UTC, an attacker exploited a vulnerability in Resolv Labs' minting mechanism, allowing them to mint 80 million USR tokens without backing. This was made possible by depositing USDC into the USR Counter contract and leveraging SERVICE_ROLE privileges, which lacked necessary mint limits and oracle checks. Within 17 minutes, the attacker dumped the minted tokens across decentralized exchanges, causing USR to crash from its peg to as low as $0.025.

PeckShieldAlert and on-chain analysts quickly issued warnings, prompting Resolv Labs to pause all protocol functions by 4:58 a.m. UTC. They confirmed the minting of 50 million USR in the initial transaction and later detailed the full scope of the exploit, including the burning of 9 million USR held by the attacker. The protocol's assets, valued at $141 million, were preserved against a backdrop of inflated supply, which included the illicitly minted tokens.

In the aftermath, Resolv Labs activated phased redemptions for pre-incident holders starting March 23, 2026, and began collaborating with law enforcement and on-chain analytics firms to trace the attacker’s assets. The attacker retained approximately 11,409 ETH, valued at around $23.7 million, alongside residual USR tokens. As a result, USR stabilized around $0.27, which is still 73% below its intended peg, leading to a market cap of $48 million. The RESOLV governance token also saw a decline of 9%.

This incident has broader implications for the DeFi ecosystem, particularly in the Gulf region, where Resolv Labs operates. The exploit has raised questions about the security of yield-bearing stablecoins and the potential risks associated with single-key vulnerabilities. While integrated DeFi platforms like Curve and Morpho reported no collateral losses, liquidity fragmentation was noted, highlighting the interconnectedness of these platforms and the systemic risks posed by such exploits.

• Stablecoin holders: Those who invested in USR or similar tokens may face immediate financial losses.
• DeFi investors: Users of integrated platforms like Curve and Morpho may experience liquidity issues.
• Regulatory bodies: Authorities in the UAE and other regions may face pressure to address vulnerabilities in the DeFi space.

• Regulatory responses: Monitor any actions taken by UAE authorities regarding DeFi protocols, which could influence market confidence.
• Recovery measures: Watch how Resolv Labs implements its recovery plan and the effectiveness of redemptions for pre-incident holders.
• Market stability: Observe USR's price movements and trading volumes over the coming weeks to gauge market sentiment and recovery.