When Your 'Stable' Coin Goes Full Depegger: USR's 80 Million Token Party Crashes DeFi

A crafty attacker turned Resolv's USR stablecoin minting mechanics into a free money printer on Sunday, conjuring roughly 80 million unbacked tokens and making off with a cool $25 million—proving that in crypto, the only thing truly 'stable' is the frequency of exploits.

The digital heist kicked off at the ungodly hour of 2:21 a.m. UTC. The exploiter deposited a modest 100,000 USDC into Resolv's USR Counter contract and, in a move that would make any degen weep with joy, received 50 million USR back—a cool 500x on their 'investment.' Not satisfied, they promptly executed an encore, minting another 30 million USR for good measure.

USR, a stablecoin supposedly pegged to the dollar and backed by the comforting weight of ETH and BTC, proceeded to do the exact opposite of stabilizing. It nosedived to a pitiful $0.025 on its most liquid Curve Finance pool within 17 minutes, a depeg so fast it left liquidity providers holding digital bags. It later staged a partial comeback to around $0.85, but by Sunday morning, the peg was still more of a suggestion than a rule.

The attacker, displaying the classic exit strategy of a rug-puller who just won the lottery, swapped their freshly minted Monopoly money for real USDC and USDT across various DEXs, before finally cashing out into the king of crypto: ETH. On-chain sleuths confirm the villain's wallet is now sitting pretty on 11,409 ETH, worth a life-changing $23.7 million.

In a statement dripping with the calm of a captain announcing a minor technicality as the ship lists, Resolv Labs declared it had paused all protocol functions. They insisted their collateral pool was "fully intact" with "no underlying assets" lost, framing the catastrophic failure as an "isolated" issue with USR issuance mechanics—because what's $25 million among friends?

On-chain analysts quickly pointed the finger at the protocol's SERVICE_ROLE, a privileged account controlled by what appears to be a single, vulnerable wallet instead of a secure multisig. The minting contract itself was apparently built on hope, lacking basic safeguards like oracle checks, amount validation, or even a maximum mint limit. It was, in essence, an open invitation with a neon sign.

This wasn't a classic vault robbery; it was a masterclass in monetary policy gone rogue. By inflating the supply by 80 million tokens out of thin air, the attacker diluted the entire pool. Their subsequent sell-off then vaporized the liquidity, ensuring every regular holder of USR watched their balance sheet turn into a meme. The value was stolen through inflation, not extraction—a subtle but brutal distinction.

The depeg didn't stay in its lane, rippling out into DeFi lending markets where USR and its wrapped sibling, wstUSR, were being used as collateral on platforms like Morpho and Gauntlet. Opportunistic traders likely swooped in to buy the heavily discounted USR and then borrowed USDC against it at the hardcoded $1 valuation, effectively draining those vaults of stablecoin liquidity in a classic 'bank run' executed at blockchain speed.

The fallout might even reach Resolv's so-called insurance layer, the junior tranche known as the Resolv Liquidity Pool (RLP), which had about $38.6 million in circulation before things went sideways. The largest RLP holder is Stream Finance, a name that might ring a bell for its own $93 million 'oopsie' back in November 2025—because in crypto, pain loves company.

USR's market cap had already been on a slide from a lofty $400 million in early February to a more modest $100 million just before the attack, a trend the exploit enthusiastically accelerated. Unsurprisingly, the RESOLV governance token also took a hit, shedding about 8.5% of its value in 24 hours, as governance tokens are wont to do when the underlying protocol implodes.

For context, the Abu Dhabi-based Resolv project had previously raised a