Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens
Resolv Labs USR stablecoin and holders
On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery.
Why this severity: $25M reported stolen.
- Started
- Mar 21, 2026
- Closed
- Apr 1, 2026
- Chains
- Ethereum
- Reported stolen
- $25M
At risk
- Resolv Labs USR stablecoin and holders
- Ethereum wallets
What to do now
- Follow only Resolv's official channels for redemption and recovery steps.
- Check lending positions that used USR as collateral.
- Ignore 'claim your USR refund' links in DMs or replies.
Stay safe
Am I affected?
If you held USR or wstUSR, or used them as collateral in lending markets, around 21-22 March 2026.
What to do now
- Follow only Resolv's official channels for redemption and recovery steps.
- Check lending positions that used USR as collateral.
- Ignore 'claim your USR refund' links in DMs or replies.
How to avoid this
- Stablecoins whose minting depends on an off-chain signer carry key risk; prefer designs with on-chain mint caps and rate limits.
- Don't keep all savings in one yield-bearing stablecoin.
- For teams: enforce hard mint limits on-chain and keep signing keys in HSM or MPC setups with alerts.
Timeline 3
Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.
SourceResolv temporarily paused its app and later enabled redemptions while contacting verified holders.
SourceUsing a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.
Source
News & write-ups ›2
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.