Resolv: The $25 Million Stablecoin That Minted Itself to Death

At 02:21 UTC on Sunday 22 March 2026, someone deposited 100,000 USDC into Resolv and received 50 million USR in return. USR was meant to be a dollar: one token, one dollar. The depositor had just bought fifty million of them for a fifth of a cent each. Eighty minutes later a second deposit of the same size produced another 30 million.

By the time Resolv paused its contracts at 05:16 UTC, the attacker had swapped the new tokens through hundreds of trades into 11,409 ETH, worth about $25 million. USR, which had been trading at a dollar, fell to two and a half cents in one trading pool on Curve, the stablecoin exchange, within 17 minutes of the first mint, and spent the day far below its peg. Lending apps that had accepted USR as collateral were left holding millions of dollars of loans backed by something close to worthless.

What Resolv was selling

USR was a stablecoin, a digital dollar that lives on a blockchain. Most stablecoins, such as Circle's USDC, are backed by cash and Treasury bills in a bank. Resolv's was backed by crypto. It held Ether and Bitcoin and, at the same time, bet against them with an equal-sized short position in the futures market, so that a fall in price on one side was cancelled by a gain on the other. A share trader would call it a hedged book. Holders who staked USR earned a yield from the interest those futures positions paid.

Above USR sat a second token, RLP, the Resolv Liquidity Pool. RLP holders took the first loss if the hedge went wrong, in return for a higher yield, much like the junior tranche of a bond that is paid more because it gets hit first. Resolv Labs, co-founded by Ivan Kozlov, said its collateral pool held about $141 million on the day of the attack. USR's market value had fallen from about $400 million in early February to roughly $100 million.

Minting new USR was a two-step process. A user deposited collateral into a smart contract, code that moves money by itself, called the Counter. A separate computer program run by Resolv then checked the deal and signed off on how many USR to issue. The smart contract trusted that signature completely. There was no cap on how many USR one deposit could create and no check that the number matched the money paid in. If the signing key said 50 million, the contract issued 50 million.

A contractor, a GitHub login and a cloud key

Resolv's post-mortem, published on 4 April, traced the break-in to someone outside the company. A contractor who had worked for Resolv had also contributed to another crypto project. When that other project was hacked, the attackers found a broadly permissioned credential tied to the contractor's GitHub account, the service where software teams store and share their code. It still opened doors at Resolv.

From inside Resolv's code repositories the attackers planted a malicious automated workflow, the kind of script that runs every time code is updated, which quietly copied out credentials without setting off alarms for unusual network traffic. They then removed their own access to cover their tracks. With the stolen credentials they explored Resolv's cloud account. Several attempts to reach the signing key were refused. Eventually they used a higher-level role to rewrite the key's access policy and give themselves permission to sign. The security firm Halborn said the key sat in Amazon Web Services' key management service.

Resolv's monitoring flagged the first mint almost at once, but the team took about an hour to start responding and nearly three hours to pause the contracts. In between, the attacker minted the second 30 million.

The damage spread to lenders

USR was used as collateral across DeFi, the set of lending and trading apps that run on public blockchains. Many of those apps valued USR at a fixed one dollar rather than at its market price, the way a pawnbroker might value a watch by the price on its tag. When USR collapsed, borrowers could still pledge it at a dollar.

Morpho, a lending marketplace, was hit hardest. Its co-founder Paul Frambot said about 15 vaults were affected. Analysis compiled by Rekt found that automated vaults supplied about $6.2 million of fresh USDC into broken USR markets after the attack had started, 96% of it from vaults curated by the risk firm Gauntlet. Omer Goldberg, founder of Chaos Labs, said the automation "had no circuit breaker". The lending app Fluid faced about $11 million of potential bad debt; Lista DAO and Venus said USR-backed loans had been repaid or cleared. Stream Finance had about $17 million exposed through RLP. Charles Guillemet, chief technology officer at Ledger, said it was "not a Terra Luna-type event", because most of USR's real collateral was still there.

Who got paid back, and who did not

Resolv posted an on-chain ultimatum: return 90% of the ETH within 72 hours, keep 10% as a bounty, and face no pursuit. The attacker did not reply. Resolv used blacklisting and burning to neutralise about 46 million of the 80 million illicit USR, including 36.73 million wstUSR and stUSR burned from attacker wallets on 6 April. It hired Mandiant and the blockchain investigator ZeroShadow and notified the authorities. No one has been named or charged, and the 11,409 ETH has not been returned.

Ivan Kozlov promised that everyone who held USR before the attack would get a dollar for each token, and by 31 March 98% of verified holders had been repaid. The Resolv Foundation's recovery plan of 26 May set the rest. Anyone who bought USR after the attack got 50 cents per token. RLP holders, the insurance layer, got 0.71 USDC per RLP plus 2.71 RESOLV tokens, which Resolv valued at about 60% of the pre-attack price. Leveraged RLP positions that had been liquidated got nothing more. The claim window ran from 26 May to 26 August 2026.

Resolv has since moved on to Vault Street, a new business line selling tokenised Treasury bill products to professional investors. The ETH remains with whoever holds that GitHub credential.