Stablecoin Shenanigans: How a $100k Deposit Spawned $80M in 'Funny Money' and a $25M Heist

Resolv Labs' supposedly stable coin, USR, decided to explore life off the dollar peg after a crafty degen found a minting flaw and conjured up roughly 80 million unbacked tokens from the digital ether. The Sunday funday exploit saw a single wallet deposit a cool $100k in USDC and, as if saying "abracadabra," trick the contract into coughing up 50 million USR, then another 30 million for good measure, according to on-chain sleuths at PeckShield.

In a classic case of closing the stable door after the horse has bolted, the protocol slammed the pause button on all functions to prevent further financial carnage. D2 Finance pointed out the minting logic was about as robust as a paper boat, suggesting the oracle was gamed, the off-chain signer got pwned, or the team simply forgot to check if the numbers added up—basic arithmetic is hard, apparently.

The attacker’s playbook was a masterclass in DeFi exit liquidity: the freshly printed USR was promptly dumped for USDC and USDT across various decentralized exchanges, then yeeted into ETH faster than a degen chasing a 100x meme coin. D2 Finance pegs the haul at around $25 million in ETH, while liquidity in the Curve USR/USDC pool did a disappearing act, tanking USR's price to a pitiful $0.025 before it managed a shaky recovery to roughly $0.84-$0.87—a solid 13% discount for the truly brave.

CoinGecko data shows USR currently clinging to life near $0.87, while the project's governance token, RESOLV, took a 6% haircut to $0.054 on the news. Despite the price chart looking like a heart attack, Resolv Labs is adamant its collateral pool—stacked with ETH, staked ETH, and Bitcoin—is still sitting pretty and that no actual underlying assets were lost; just the faith of anyone holding their stablecoin.

This little debacle lands just as reports show overall crypto hacks are trending down, with February seeing a mere $49 million in losses compared to January's $385 million bonanza, as attackers pivot to phishing noobs instead of cracking code. The USR de-peg is a spicy reminder that an audit is just a snapshot, and without real-time monitoring of minting and supply, your protocol is basically inviting anomalies to come party.

All protocol functions are still on ice while Resolv Labs plays digital detective, investigates the breach, and presumably works on a recovery plan that doesn't involve hoping for the best.