Resolv Labs Hacker Mints ₱4.8 billion ($80 million) USR Tokens, Steals ₱1.38 billion ($23 million) in Ether
After gaining unauthorized access to Resolv Labs' AWS infrastructure, a hacker exploited missing safeguards to mint 80 million unbacked USR stablecoin tokens using just $100,000 to $200,000 in collateral. The attacker drained ₱1.38 billion ($23 million) in Ether before the protocol could respond.
Key Takeaway
Missing oracle checks let hackers mint unlimited stablecoin tokens — basic safeguards matter more than complex code.
A hacker exploited Resolv Labs' cloud infrastructure to mint 80 million unbacked USR stablecoin tokens, draining ₱1.38 billion ($23 million) in Ether before the protocol could respond.
The attacker gained unauthorized access to Resolv's key management service hosted on Amazon Web Services, according to the protocol's statement on March 22, 2026. Chainalysis reported the hacker used just $100,000 to $200,000 in collateral to mint the massive token supply. USR, which launched in September 2024, collapsed from its $1 peg to as low as $0.02 on CoinGecko before recovering slightly to trade below $0.4.
Herd co-founder Andrew Whong said the mint contract lacked basic safeguards that could have prevented the exploit. The protocol had no oracle or max mint checks in place to stop unauthorized token creation. The hacker swapped the fraudulent USR for Circle's USDC stablecoin, then converted the proceeds to Ether before Resolv could freeze the protocol.
Morpho Labs, a lending protocol that supported USR vaults, confirmed its smart contracts remained secure despite the damage to its ecosystem. Morpho co-founder Merlin Egalite said there is no vulnerability in Morpho contracts and they are operating as intended. However, Chaos Labs founder Omer Goldberg reported that some Morpho curators with automated liquidity services kept providing liquidity to USR vaults for hours after the exploit, making the losses worse.
Resolv Labs paused all protocol functions immediately after discovering the breach. The protocol had raised ₱599.84 million ($10 million) in seed funding led by Cyber.Fund and Maven11, with backing from Coinbase Ventures and Arrington Capital. Morpho co-founder Paul Frambot said roughly 15 vaults with more than $10,000 in liquidity were impacted on March 22, 2026.
This article was written based on reporting from Dlnews.
