DeFi stablecoin loses peg after $80M exploit

TLDR

Resolvs USR stablecoin lost its dollar peg after an attacker abused a privileged key to mint about $80 million of unbacked tokens and exit with roughly $25 million in value.

1. The exploit used a compromised off-chain signing key to mint 80 million uncollateralized USR, crashing the price over 70 percent in hours.
2. Resolv paused the protocol and started redemptions for pre-incident holders, but current collateral covers only a fraction of USR liabilities.
3. The incident is rippling into DeFi lending markets and highlights design risks around off-chain keys and assumed 1 dollar stablecoin oracles.

Deep Dive

1. How The Exploit Happened

According to detailed post-mortems, the attacker gained control of a privileged signing key held in Resolvs infrastructure (reported as AWS KMS) and used it to approve USR mints that were not fully backed by collateral. A few hundred thousand dollars of USDC deposits were used to justify minting about 80 million USR, which were then converted into wrapped staked USR and swapped into other stablecoins and ETH, yielding roughly $24 to $25 million in value for the attacker in under 20 minutes, as described in a recent analysis of the incident.

Because the minting logic relied on this single off-chain key and lacked strict on-chain limits or collateral checks, the smart contracts behaved as designed while the economic model collapsed. USRs price fell from around 1 dollar to lows near $0.05 before partially recovering to the $0.20 to $0.30 range in subsequent trading in some reports.

2. Impact On Holders And DeFi

Reports indicate the protocol now has on the order of $95 million in assets against roughly $173 million of USR liabilities, implying about 55 percent collateralization and making USR economically undercollateralized even after emergency burns of illicitly minted tokens described in a recent market review. Resolv has paused contracts and is prioritizing redemptions for pre-incident USR via an allowlist, with some estimates suggesting these users might recover around 90 cents on the dollar if they redeem early before collateral is exhausted.

The depeg also hit DeFi lending protocols that treated USR or wstUSR as near 1 dollar collateral. Analytics on the broader DeFi impact describe over $10 million in bad debt at Fluid and significant exposure in Morpho vaults and other markets that had to pause USR-related activity.

3. Key Lessons And What To Watch

This incident highlights several systemic risks. First, stablecoins that depend on off-chain keys or infrastructure without strict on-chain mint limits concentrate risk in a single operational point of failure. Second, DeFi money markets that hardcode a stablecoins price near 1 dollar, or rely on stale oracles, can create large bad debt when a depeg occurs, as seen in multiple similar incidents over the past year.

Going forward, important signals to monitor include:

1. How much of USRs circulating supply is redeemed or written off.
2. Whether Resolv publishes a credible plan to decentralize or harden its minting controls.
3. How quickly lending protocols update risk frameworks around yield-bearing stablecoins and collateral oracles.

Conclusion

An attacker did not drain Resolvs collateral directly but instead exploited a centralized minting key, inflating USR supply until the peg collapsed. That design failure is now propagating through lending markets, creating bad debt and partial recoveries rather than clean reimbursements. Whether USR survives or not, the clearer lesson for DeFi users and builders is that stablecoin safety depends as much on governance, key management, and oracle design as on the size of the collateral pool.