According to a statement from Resolv Labs, the vulnerability allowed the hacker to mint around 50 million unbacked USR.
At the time of writing, the US dollar-pegged token had dropped to around $0.56, according to CoinGecko data.
Researchers from D2 published an analysis of the incident. According to their findings, the attacker deposited 100,000 USDC into the USR Counter contract via the requestSwap function and received 49.95 million USR.
The amount was roughly 500 times larger than the deposit due to a flawed smart contract.
“Either the oracle was manipulated, the validator was compromised offline, or there is simply no proper validation between the request and finalization stages,” the researchers noted.
Following the initial exploit, the attacker rapidly withdrew funds using a typical DeFi strategy. The minted USR was converted into wstUSR and distributed across multiple platforms for sale.
Trades were executed with high slippage due to depleted liquidity, which further accelerated the depeg of USR. The attacker eventually bridged the funds across networks and exited the positions.
Researchers estimate total losses at approximately $25 million.
“The key question is how a swap request of 100,000 USDC was finalized as 50 million USR via completeSwap. There must be an explanation for what happened between these two steps,” D2 added.
The project team has not yet provided additional technical details. The company stated it is working on mitigating the damage and recovering lost funds.
Resolv is a stablecoin issuance platform that offered high yields based on delta-neutral strategies using Ethereum and Bitcoin.
The Resolv incident highlights that even advanced DeFi models remain vulnerable to flaws in smart contract logic and protocol design. The loss of the USR peg and the scale of losses are likely to further undermine confidence in algorithmic and hybrid stablecoins. In the near term, the key factors will be the team’s response speed and the transparency of the investigation.
