Resolv’s USR stablecoin has lost its peg following a major exploit that exposed critical weaknesses in the protocol, leaving it significantly undercollateralized.

The system now holds around $95 million in assets against $173 million in liabilities, effectively rendering it insolvent. USR is trading near $0.27, down roughly 72% over the past week—well below its intended $1 value.

The breach took place around 2:21 a.m. UTC on Sunday, when an attacker exploited a flaw in the minting contract to create approximately 80 million unbacked USR tokens across two transactions. The attacker extracted about $25 million, according to blockchain security firms and onchain data.

The funds were quickly moved through decentralized exchanges, with the attacker swapping USR into USD Coin and Tether before converting the proceeds into Ethereum. The attacker now holds roughly 11,409 ETH—worth about $23.7 million—along with $1.1 million in wrapped USR in another wallet.

USR, which uses a delta-neutral strategy backed by ETH and BTC, saw its price collapse to as low as $0.025 within minutes on its most liquid pool on Curve Finance. Although it briefly rebounded to around $0.85, it has since failed to restore its peg.

Structural vulnerabilities uncovered

While the Resolv team initially attributed the incident to a compromised private key and infrastructure breach, further investigation revealed deeper design flaws within the protocol.

A key issue was the SERVICE_ROLE, a privileged function in the minting contract responsible for handling swap operations. This role was controlled by a single externally owned account instead of a multi-signature setup. Additionally, the contract lacked essential protections such as oracle checks, mint limits and validation mechanisms.

This allowed the attacker to deposit just 100,000 USDC and receive 50 million USR in return—around 500 times the expected amount—with no safeguards in place to detect the anomaly.

Ido Sofer, founder of Sodot, said such centralized control points often become overlooked vulnerabilities. He added that attackers are increasingly targeting sensitive credentials—like developer keys and API access—that don’t directly hold funds but can still be used to compromise systems.

Declining liquidity and recovery efforts

Data from DeFiLlama shows Resolv’s total value locked peaked near $684 million in February 2025 before falling steadily to about $95 million ahead of the exploit, indicating declining confidence prior to the attack.

Resolv said it is working with law enforcement and blockchain analytics firms to trace and recover the stolen funds. The team has also advised users to avoid trading USR during the recovery process, warning that such activity could impact restitution outcomes.

With a large gap between assets and liabilities and trust significantly eroded, restoring the stablecoin’s peg remains a major challenge.