Overview
- An attacker exploited USR’s minting flow around 2:21 a.m. UTC Sunday to create roughly 80 million unbacked tokens across two transactions and now holds 11,409 ETH worth about $25 million.
- USR plunged to as low as just over 2 cents on Curve before stabilizing far below its peg and was trading near $0.27 on Monday, with no full recovery of parity.
- Investigators cite a single externally owned SERVICE_ROLE plus absent oracle checks, amount validation, and hard mint caps, which let 100,000 USDC return 50 million USR.
- Resolv paused protocol operations, said the collateral pool remains intact, is working with law enforcement and on-chain analytics, burned about 9 million attacker-held USR, and plans allowlisted redemptions for pre-incident holders.
- CoinDesk reports the protocol holds about $95 million in assets against $173 million in liabilities, indicating functional insolvency, while major DeFi platforms such as Aave, Morpho, and Lido reported limited direct impact to core systems.