{
 "slug": "resolv-usr-minting-key-compromise-mar-2026",
 "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
 "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026",
 "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "key-leak",
 "product": "Resolv Labs USR stablecoin and holders",
 "tags": [
  "ethereum",
  "key-leak",
  "resolv",
  "usr",
  "stablecoin",
  "depeg",
  "private-key-compromise",
  "off-chain-signer",
  "minting"
 ],
 "amountUsd": 24500000,
 "victims": null,
 "startedAt": "2026-03-21",
 "closedAt": "2026-04-01",
 "updatedAt": "2026-04-01T12:00:00Z",
 "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery.",
 "timeline": [
  {
   "date": "2026-03-21",
   "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million"
  },
  {
   "date": "2026-03-23",
   "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million"
  },
  {
   "date": "2026-04-01",
   "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Hacker breaches Resolv DeFi platform, steals $25 million",
   "url": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "publisher": "The Record",
   "date": "2026-03-24"
  },
  {
   "kind": "writeup",
   "title": "Month in Review: Top DeFi Hacks of March 2026",
   "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026",
   "publisher": "Halborn",
   "date": "2026-04-01"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you held USR or wstUSR, or used them as collateral in lending markets, around 21-22 March 2026.\n\n## What to do now\n- Follow only Resolv's official channels for redemption and recovery steps.\n- Check lending positions that used USR as collateral.\n- Ignore 'claim your USR refund' links in DMs or replies.\n\n## How to avoid this\n- Stablecoins whose minting depends on an off-chain signer carry key risk; prefer designs with on-chain mint caps and rate limits.\n- Don't keep all savings in one yield-bearing stablecoin.\n- For teams: enforce hard mint limits on-chain and keep signing keys in HSM or MPC setups with alerts.",
 "notes": null,
 "agentBrief": "# Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Ethereum · Method: Leaked private keys and seed phrases\n- Started: Mar 21, 2026 · Last update: Apr 1, 2026 · Reported stolen: $25M\n- Who/what: Resolv Labs USR stablecoin and holders\n\nOn 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery.\n\n## Am I affected?\nIf you held USR or wstUSR, or used them as collateral in lending markets, around 21-22 March 2026.\n\n## What to do now\n- Follow only Resolv's official channels for redemption and recovery steps.\n- Check lending positions that used USR as collateral.\n- Ignore 'claim your USR refund' links in DMs or replies.\n\n## How to avoid this\n- Stablecoins whose minting depends on an off-chain signer carry key risk; prefer designs with on-chain mint caps and rate limits.\n- Don't keep all savings in one yield-bearing stablecoin.\n- For teams: enforce hard mint limits on-chain and keep signing keys in HSM or MPC setups with alerts.\n\n## Sources\n- Hacker breaches Resolv DeFi platform, steals $25 million (The Record, 2026-03-24): https://therecord.media/hacker-breaches-resolv-defi-25-million\n- Month in Review: Top DeFi Hacks of March 2026 (Halborn, 2026-04-01): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026\n\nFull record: https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026 · JSON: https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}