# Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens

- Severity: Critical · Status: Contained (past)
- Chains: Ethereum · Method: Leaked private keys and seed phrases
- Started: Mar 21, 2026 · Last update: Apr 1, 2026 · Reported stolen: $25M
- Who/what: Resolv Labs USR stablecoin and holders

On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery.

## Am I affected?
If you held USR or wstUSR, or used them as collateral in lending markets, around 21-22 March 2026.

## What to do now
- Follow only Resolv's official channels for redemption and recovery steps.
- Check lending positions that used USR as collateral.
- Ignore 'claim your USR refund' links in DMs or replies.

## How to avoid this
- Stablecoins whose minting depends on an off-chain signer carry key risk; prefer designs with on-chain mint caps and rate limits.
- Don't keep all savings in one yield-bearing stablecoin.
- For teams: enforce hard mint limits on-chain and keep signing keys in HSM or MPC setups with alerts.

## Sources
- Hacker breaches Resolv DeFi platform, steals $25 million (The Record, 2026-03-24): https://therecord.media/hacker-breaches-resolv-defi-25-million
- Month in Review: Top DeFi Hacks of March 2026 (Halborn, 2026-04-01): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026

Full record: https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026 · JSON: https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.