Resolv Says Compromised Key Enabled $24.5 Million USR Exploit
Summary
Resolv says a compromised private key enabled an attacker to mint about $80 million in uncollateralized USR and exchange it for roughly 11,408 ETH ($24.5 million), depegging USR. The platform paused its app and enabled verified-user redemptions.
Key points
- Resolv said an attacker gained unauthorized access to its infrastructure through a compromised private key.
- The attacker minted about $80 million in uncollateralized USR after depositing roughly $100,000–$200,000 in USDC, according to Chainalysis.
- The attacker exchanged much of the minted USR for about 11,408 ETH, worth roughly $24.5 million; USR fell to about $0.26.
- Chainalysis attributed the failure to reliance on off-chain infrastructure and the absence of a maximum minting limit tied to the signing key.
- Resolv paused its app, enabled redemptions for verified users, and is tracing and trying to contain the illicitly minted USR.
- Resolv offered the attacker 10% of the ETH if the remaining funds were returned and further activity ceased.
Article Details
- Victim Organization
- Resolv
- Incident Type
- Compromised private key enabled unauthorized minting of uncollateralized USR and its exchange for ETH
- Affected Data Size
- Approximately $80 million of uncollateralized USR was minted; about 11,408 ETH, valued at approximately $24.5 million, was obtained in trades.
- Operational Impact
- USR depegged to approximately $0.26. Resolv temporarily paused its app, enabled redemptions for verified users, and said it was tracing and attempting to contain the illicitly minted USR.
- Ransom Or Extortion
- Resolv offered the attacker 10% of the ETH if the remaining funds were returned and further activity stopped. It also threatened to coordinate exchange restrictions or freezes and pursue law enforcement and legal action. No ransom demand by the attacker was reported.
- Claim Status
- confirmed
Products
ResolvDecentralized finance platform Resolv suffered a breach after a compromised private key allowed an attacker to mint about $80 million of uncollateralized USR and trade much of it for roughly 11,408 ETH (â $24.5M),USRa breach after a compromised private key allowed an attacker to mint about $80 million of uncollateralized USR and trade much of it for roughly 11,408 ETH (â $24.5M), causing USR to depeg to about $0.26.