USR Stablecoin Exploit Mints 80M Unbacked Tokens

A vulnerability in the minting contract of Resolv Labs' USR stablecoin allowed an attacker to generate approximately 80 million unbacked tokens on Sunday, causing the asset to lose its peg to the U.S. dollar and triggering a sharp decline in its value across decentralized finance platforms.

The exploit occurred around 2:21 a.m. UTC, when the attacker deposited about 100,000 worth of USDC, a dollar-pegged stablecoin, to mint an initial 50 million USR tokens. Blockchain security firm PeckShield later confirmed a second minting event added another 30 million tokens, exploiting a flaw in the contract's logic that bypassed proper validation. Analysts from D2 Finance and Cyvers attributed the breach to potential issues such as manipulated oracles, a compromised offchain signer, or inadequate checks on minting amounts. Although the contracts had undergone audits, the vulnerability enabled the creation of tokens without corresponding collateral, leading to an immediate imbalance in supply.

Following the minting, the attacker rapidly swapped the unbacked USR for stablecoins including USDC and USDT on platforms such as Curve Finance, KyberSwap, and Velodrome, before converting the...