Resolv Labs DeFi Hack Extracts $25M, Tokens Burned

Resolv Labs, a decentralized finance protocol, suffered a major security breach on March 22, 2026, when a hacker exploited vulnerabilities in its offchain minting infrastructure to create 80 million unbacked USR tokens, leading to the extraction of approximately 25 million in value. The protocol responded by upgrading its smart contracts on April 6, 2026, to burn 36.73 million tokens held by the attacker, neutralizing a significant portion of the illicit assets and capping net losses at around 34 million.

The attack began with a compromised private key hosted on Amazon Web Services, which controlled the protocol's service role for minting approvals. Using deposits of just 100,000 to 200,000 USDC as collateral, the hacker authorized two large minting transactions: one for 50 million USR and another for 30 million. This bypassed onchain checks and maximum limits, flooding the market with unbacked tokens. The attacker quickly swapped about 34 million USR for 11,409 ETH, valued at roughly 24.5 million at the time, before liquidity pools were depleted. The remaining tokens, largely wrapped as wstUSR or stUSR, sat dormant in attacker-controlled wallets.