Resolv Labs Stablecoin Faces Depeg After Exploit

A stablecoin associated with Resolv Labs has lost its peg to the US dollar following an exploit that allowed an attacker to generate millions of tokens. According to Cointelegraph, Resolv Labs announced on X that an attacker had minted 50 million unbacked Resolv USR (USR) tokens. The team has paused all protocol functions to prevent further malicious activities and is actively working on recovery. The X account 'yieldsandmore' reported earlier that USR had crashed after on-chain data revealed an attacker minted 50 million USR by depositing $100,000 worth of USDC stablecoin. Additionally, the attacker managed to mint another 30 million USR tokens, as confirmed by crypto security firm PeckShield. D2 Finance noted that the minting function on USR’s contract was compromised, suggesting possible issues with the oracle, off-chain signer, or validation between request and completion. This exploit occurs amid a decline in crypto-related hacks, with February seeing $49 million lost to exploits compared to $385 million in January. Attackers are increasingly favoring phishing scams over protocol exploits. D2 Finance highlighted that the attacker swiftly moved the 50 million USR tokens to various crypto protocols, exchanging them for stablecoins USDC and USDt (USDT) before converting them to Ether (ETH). The firm described the attacker's cashout strategy as a typical DeFi hack exit. D2 Finance further noted that USR was trading as low as 50 cents in some transactions due to worsening liquidity and slippage across protocols, with multiple failed transactions visible on-chain. The attacker reportedly extracted around $25 million from the exploit, contributing to USR’s depeg. Currently, USR is trading at approximately 87 cents, about 13% below its intended $1 peg, according to CoinGecko. The token experienced a significant drop to 2.5 cents in a USR/USDC pool on Curve Finance, USR’s most liquid pool with a 24-hour volume of $3.6 million, as per DEX Screener. USR reached its lowest point on Curve at 2:38 am UTC on Sunday, shortly after the attacker minted $50 million worth of the token. The pool has since recovered, with USR trading at 84.5 cents.