Resolv Labs Exploit Response Burns 46M Unauthorized USR Tokens

MakeCryippreferred on

Resolv Labs has permanently eliminated around 46 million tokens, representing 57% of the 80 million USR illicitly minted during the March 22 exploit. The protocol achieved this through a combination of direct burns and blacklisting of wrapped assets held by attacker-linked wallets. As a result, no transferable or convertible illicit USR remains on exploiter-controlled addresses, marking a significant step in containing the fallout from the private key compromise.

Mitigation Actions Taken

Resolv Labs responded rapidly on the day of the incident by burning approximately 9 million USR across two Ethereum transactions, directly shrinking the unauthorized supply. The team then targeted the larger portion held as wstUSR by upgrading the wstUSR smart contract to enable blacklisting, while strictly following the contract’s mandatory 72-hour timelock to preserve governance integrity. In the final phase, any remaining direct USR holdings on exploiter addresses were burned in a separate transaction. These coordinated on-chain actions collectively removed 57 percent of the illicit supply and eliminated immediate pathways for the attacker to move or monetize the unbacked tokens further.

Broader Recovery Efforts

The protocol has implemented an allowlist-based redemption process limited to verified pre-exploit USR holders, while keeping select functions paused to protect remaining collateral. With assets valued at approximately $95 million against substantially higher liabilities, the collateralization ratio sits well below full coverage, underscoring the financial pressure created by the incident. Resolv Labs continues to trace on-chain movements in collaboration with security researchers and law enforcement, while assessing options such as recovery bounties. This measured approach seeks to safeguard legitimate participants and minimize spillover into connected DeFi markets that had integrated USR as collateral.

Market Impact Assessment

The exploit triggered an immediate and severe de-peg of the USR stablecoin. The token plunged from its $1 peg to as low as $0.025 on the most liquid Curve Finance USR/USDC pool within just 17 minutes of the first minting transaction. Trading volumes surged amid panic selling, but thin DEX liquidity led to extreme slippage and temporary price levels as low as $0.02–$0.05 across certain pools and venues. The token later staged a partial recovery, trading in the $0.20–$0.40 range in the hours and days following the incident. As of March 26, 2026, USR was hovering around $0.27–$0.31, still significantly below parity. Several interconnected DeFi protocols responded swiftly by pausing USR-related markets or disabling it as collateral to limit contagion, with reported exposures in lending vaults reaching several million dollars before containment measures took effect.

This sharp supply shock and liquidity crunch highlighted vulnerabilities in stablecoin markets during rapid, unauthorized mint events, contributing to a notable contraction in USR’s market capitalization and reduced trading activity across major venues. For a deeper technical understanding of how the attack unfolded and the vulnerabilities involved refer to the Resolv Labs exploit analysis.