Resolv Labs Removes 57% of Illegally Minted USR Tokens



A hacker exploited Resolv's private key via AWS Key Management Service, minting 80M unbacked USR tokens using just ~$100K in USDC.

The attacker converted USR to wstUSR, swapped into stablecoins, and cashed out ~$25M in ETH (11,409 ETH) before anyone could react.

USR crashed from $1 to $0.025 on Curve Finance within 17 minutes.

Resolv's Response:
→ Burned ~9M USR on Day 1
→ Upgraded wstUSR contract to blacklist attacker wallets
→ Total 46M tokens (57%) permanently removed
→ No illicit USR remains on attacker addresses now.

But the reality:
→ Attacker already cashed out ~$25M in ETH
→ Protocol holds ~$95M assets vs higher liabilities (functionally insolvent)
→ USR peg NOT restored
→ 18 audits failed to catch the flaw

Root Cause: No mint limits, no oracle checks, single private key controlled minting. No multisig.

Key Lesson: Smart contract audits alone are NOT enough. Off-chain infrastructure security is equally critical for DeFi protocols.

Redemptions open only for pre-exploit USR holders via allowlist. Do NOT trade USR during recovery.
USDC0,03%
ETH-4,38%
CRV-5,88%
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin