Attack Method: The attacker used about $100,000 USDC, exploiting a critical vulnerability in the USR minting function—possibly due to manipulated oracles, leaked off-chain signer keys, or a lack of amount verification between minting requests and execution—to mint 80 million USR (worth about $80 million) out of thin air, and then quickly exchanged it for real assets.
Arbitrage Path: The attacker illegally minted USR and sold it in batches to liquidity pools like Curve Finance, causing the USR price to drop to a low of 2.5 cents. Amidst the chaos of the de-pegging, approximately $25 million was cashed out, and then the arbitrage gains were converted to ETH for laundering.
Loss distribution: According to the design logic of Resolv's dual-layer risk architecture, the collateral gap caused by this attack is first borne by RLP insurance pool holders (the price of RLP will decline as the net asset value of the protocol decreases), while USR holders are theoretically protected before the protocol pauses redeeming; however, the leveraged looping positions of USR on lending protocols like Morpho faced forced liquidation due to unpegging, resulting in secondary losses.
Collateralized protocols: The major affected DeFi protocols include: Curve Finance (the USR/USDC liquidity pool collapsed instantly), Morpho (USR as collateral triggered liquidation), Fluid and Euler (also having USR/RLP looping positions).
Industry warning: This incident revealed a fundamental weakness in Delta neutral stablecoins—the coupling of minting logic with off-chain signatures/oracles is the system's most vulnerable attack surface, and any "1 dollar mints 1 dollar" capital efficiency design must be predicated on extremely rigorous contract security audits.
I. RESOLV and USR: Understanding this system is key to understanding this attack
Before discussing the attack, we must first clarify how USR operates—because the attacker exploited the most ingenious yet fragile part of its design.
The core mechanism of USR: Delta neutral stablecoin
USR is not a stablecoin supported by bank deposits like USDT, nor is it an over-collateralized stablecoin like DAI. It is a Delta neutral stablecoin—an architecture that achieves net risk neutrality by "holding ETH spot in one hand + shorting ETH perpetual contracts in the other hand"[Note 1].
The logic is as follows:
When you deposit $1 of ETH to mint 1 USR, the Resolv protocol simultaneously opens an equivalent short position in the perpetual contract market. If ETH rises, the spot makes money and the contract loses; if ETH falls, the contract makes money and the spot loses—offsetting each other, the net asset remains approximately $1. This decouples USR from ETH prices while maintaining a 1:1 dollar peg[Note 2].
The advantage of this architecture is extremely high capital efficiency: you only need $1 of ETH to mint 1 USR, without the need for over-collateralization. The source of income comes from the funding rates of hedge positions (fees paid by long positions to short positions) and ETH staking yields, allowing USR holders to receive approximately 5-6% annualized returns, with the staked version stUSR offering even higher rates[Note 3].
Dual-layer architecture: Risk isolation between USR and RLP
To address the question of "who bears the operational risks of the protocol," Resolv designed a dual-token structure:
USR layer (higher priority): Holders enjoy stable anchoring protection, and losses are not borne by them;
RLP layer (junior tranche): RLP holders act as the protocol's "insurance pool," bearing market risks, counterparty risks (such as continuously negative funding rates), and potential contract risks, in return for higher yields (20-40% annualized)[Note 4].
The rules are clear: any losses are first deducted from RLP and then from USR. When the collateralization rate of USR drops below 110%, RLP redemption will be automatically frozen to prioritize protection for USR holders[Note 5].
This is a key premise for understanding the loss distribution from this attack.
Core of the attack: What exactly went wrong with the minting function?
This is currently the most critical and least complete information link. On-chain data has confirmed one thing: the attacker "bought" $50 million worth of USR with $100,000 of USDC[1]. This 1:500 minting ratio means that the contract's minting amount verification completely failed.
Crypto fund D2 Finance provided three possible attack path hypotheses[Note 9]:
Hypothesis A: Oracle Manipulation. The minting price of USR relies on price oracles. If the attacker can temporarily lower the oracle quote in a transaction (for example, by crashing the price via a flash loan), making the contract believe that the value of the assets deposited by the user is higher, they can mint excessive USR[Note 6].
Hypothesis B: Compromise of off-chain signer keys. The minting process of Resolv includes an off-chain signature verification step—users' minting requests need to be signed by the protocol's backend service to be executed. If this signing key is stolen, the attacker can forge legitimate minting instructions of any amount, bypassing all on-chain restrictions[2].
Hypothesis C: Missing amount validation between request and execution (Validation Gap). The minting process consists of "initiating a request" and "executing the minting" in two steps. If the contract does not strictly verify that the final execution amount is consistent with the requested amount during execution, the attacker may tamper with the parameters after initiating the request but before execution, achieving excessive minting.
As of the writing of this report, the Resolv team has not yet released a complete root cause analysis (RCA) of the vulnerabilities; therefore, the priority of the aforementioned three hypotheses cannot be definitively confirmed.
Based on the attack's effects, the likelihood of Hypothesis B (signer key leakage) or Hypothesis C (validation logic missing) seems higher—because oracle manipulation usually requires large funds and is difficult to achieve such extreme price deviations; while the minting of 80 million USR occurred with very limited actual funds invested by the attacker, aligning more with the characteristics of "bypassing contract validation."
How the attacker cashed out: A textbook-level DeFi escape script
After the attacker obtained 80 million USR, the challenge they faced was: How to turn the falsely minted stablecoins into real value?
D2 Finance refers to it as "a textbook-level DeFi hacker cash-out path": the attacker sent USR in batches to multiple liquidity protocols, prioritizing a large sale in Curve Finance's USR/USDC pool (the largest liquidity pool for USR, with a daily trading volume of $3.6 million)[Note 10].
Because Curve's liquidity is limited, when 80 million USR suddenly poured in, the pool was completely smashed—USR's price dropped from $1 to 2.5 cents in 17 minutes. The attacker did not expect to sell everything at $1 but instead aimed to gradually convert into USDC/USDT in the range of $0.25 to $0.5, ultimately converting arbitrage funds into ETH to cash out.
PeckShield estimates that the final cash-out amount is about $25 million[Note 11]—considering the slippage losses caused by a large amount of USR sold at extremely low price ranges, this number indicates that the attacker's actual extraction ratio is about 30% ($25 million / $80 million). The remaining 70% of the "value" vanished in the huge slippage of liquidity exhaustion.
III. After the unpegging: What happened to USR, RLP, and the collateral system
The collateral rate of USR collapsed instantly
Under normal operation, USR is supported 1:1 by ETH + hedge positions. However, after 80 million uncollateralized USR were minted into the system, the actual assets corresponding to the entire USR supply were far from sufficient for 1:1 redemption—collateral rates significantly dropped below 100%.
This directly triggered the protection mechanism of the RLP layer—the protocol would theoretically freeze RLP redemptions to prioritize USR holders' protection. However, at the same time, since USR itself has already unpegged (trading at about $0.87 on the secondary market), USR holders also face losses from selling at market prices.
Cascading liquidations of lending protocols
This is one of the most underrated collateral damages in this incident.
The growth of Resolv largely depends on a strategy: users deposit USR as collateral into lending protocols like Morpho, Fluid, and Euler, borrow USDC, then buy more USR, repeating the cycle to form a leveraged looping position, with some users' leverage ratios reaching up to 10 times[3].
When the USR price plummeted from $1 to $0.87 or even lower, the collateral value of these leveraged positions evaporated by over 13% instantly. Since lending protocols automatically force liquidation when the collateral rate falls below the liquidation line, a large amount of USR was liquidated by bots, further flooding the secondary market and lowering prices—forming classic death spiral pressure[Note 7].
There is a dedicated "MEV Capital Resolv USR Vault" on Morpho, with TVL reaching a considerable scale before the attack; these positions are the main bearers of collateral damage[4].
The sharp decline of the protocol's TVL
Before the attack, Resolv's TVL had grown to several hundred million dollars (peaking at over $650 million, primarily driven by leveraged positions on Morpho and Euler). After the protocol was paused, users could not redeem USR, and the calculation of the TVL figure also fell into chaos due to the unpegging of USR price[5].
IV. Who bears the losses? Analysis of risk exposure among parties
RLP holders are the first loss layer by design. The collateral gap caused by the attack (80 million uncollateralized USR minted) will directly reflect in the decline of RLP's net value—the price of RLP is a claim on the excess collateral portion of the protocol, and when the protocol as a whole has uncovered debts, RLP will depreciate first[6].
Holders of USR leveraged positions are the ones who suffer the most actual losses. They not only face liquidation (liquidation usually comes with a penalty of 5-10%), but also sold their positions at prices below the pegged price during the unpegging of USR, making additional losses unavoidable.
Curve LP liquidity providers bore the impermanent loss—when the attacker sold large amounts of USR, the LP's pool passively absorbed a large amount of USR from "50% USR/50% USDC" (selling USDC, holding more low-priced USR), resulting in arbitrage loss[Note 8].
Ordinary USR holders: According to the design, if the protocol properly triggers the pause mechanism, USR holders can redeem at a 1:1 rate with the remaining real collateral. But the problem is: after the attack, the protocol has suspended all functions, and the redemption window is closed; actual sellers can only transact at market prices of $0.87, incurring a 13% loss from the unpegging.
V. Emergency response: Measures taken by the RESOLV team
The Resolv team's first response was to immediately suspend all protocol functions, including minting, redeeming, and transferring, to cut off further operational channels for the attacker[1].
As of the writing of this report, Resolv has publicly confirmed the occurrence of the attack, but a complete post-mortem analysis report and formal compensation plan have not yet been released. This aligns with the typical timing sequence of DeFi security incidents—the team usually needs 48-72 hours to complete on-chain evidence collection and vulnerability confirmation before publishing detailed remediation plans.
Notably, Resolv had previously partnered with Immunefi to establish a bug bounty program and deployed Hypernative's proactive security monitoring system[7]. The latter should theoretically be able to capture early warning signals of abnormal minting events—this raises a question: Did the early warning system trigger in time, or had the speed of the attack surpassed the window for human intervention?
From the extreme speed at which USR collapsed to 2.5 cents in 17 minutes, the attack was executed with high efficiency, and the reaction time window was very limited.
VI. Warnings from similar protocols: Systemic risks of DELTA neutral stablecoins
This Resolv incident is not isolated; it is a typical illustrative failure in the DeFi "synthetic dollar" space.
Core lesson one: Off-chain signers pose a centralized risk. To achieve efficient minting, Delta neutral stablecoins typically introduce off-chain backend services for order verification. This "off-chain component" is essentially a centralized power node—if its private key is leaked, the attacker effectively gains minting rights over the protocol. This brings Web2's security weaknesses into Web3[8].
Core lesson two: "1:1 capital efficiency" is a double-edged sword. The design philosophy of over-collateralized systems (like MakerDAO) is that even if there are minor vulnerabilities in contracts, the excess collateral can absorb part of the loss. Delta neutral systems reduce the buffer to zero—any failure in minting logic will directly create a proportional system gap, with no redundancy.
Core lesson three: Audits do not keep pace with rapid TVL growth. Resolv's TVL grew from less than $50 million to over $650 million in three months, primarily driven by leveraged looping strategies on Morpho. The rapid expansion of system complexity and integration points placed enormous pressure on audits. Similar lessons have been seen repeatedly in DeFi history: Euler Finance (March 2023, $197 million loss), Inverse Finance (April 2022, $15.6 million) are tragedies of "design that is reasonable but with minting/lending logic having detailed vulnerabilities"[9].
VII. Core conclusions
This attack revealed not just a contract vulnerability, but a deep-seated contradiction at the architectural level in the Delta neutral stablecoin space.
The starting point of the story is the ambitious design of USR: not relying on fiat currency reserves, not relying on over-collateralization, only relying on hedged derivatives to achieve 1:1 capital efficiency. This design was logically perfect during the uptrend—users minted 1 USR with $1 of ETH, and the protocol returned users with funding rates, rapidly accumulating hundreds of millions in TVL.
But the "1:1 capital efficiency" also means that the system has no collateral buffer at all. Once a vulnerability occurs in the minting logic—whether due to the leakage of off-chain signer keys or the lack of validation between request and execution—the attacker can mint any amount of stablecoins at nearly zero cost. This is unlike over-collateralized systems that have a safety net; it directly penetrates the system.
The birth of 80 million USR only took $100,000, 17 minutes, and a price bottom of 2.5 cents. The attacker extracted $25 million in real value, leaving the protocol with a black hole waiting to be repaired—and a bill written by RLP holders, leveraged position users, and Curve LPs that bears real costs.
The collateral damage to surrounding protocols like Curve, Morpho, Fluid, and Euler is another side of DeFi's "hypercomposability": integration among protocols amplifies gains in normal times and equally amplifies risks during crises. Ultimately, the warning is: in DeFi, every open efficiency window is an exposed attack surface. The presence of off-chain signers makes protocols more flexible, but also adds a centralized fatal weakness.
Notes
[Note 1] Delta Neutral: A financial derivatives term. Delta measures the sensitivity of an asset's price to changes in the underlying asset's price. "Delta=0" means that the position does not profit or lose as the underlying asset's price rises or falls—it has been fully hedged. For Resolv, holding $1 of ETH (Delta=+1) while shorting an equivalent amount of ETH futures (Delta=-1) gives a net Delta=0, hence the term "Delta neutral."
[Note 2] Perpetual Futures: A type of futures contract without an expiration date, which is a mainstream derivative tool in the cryptocurrency market. Holding a short perpetual contract means profiting when ETH prices fall and losing when they rise, thereby hedging the price risk of spot ETH.
[Note 3] Funding Rate: The balancing mechanism of the perpetual contract market. When long positions exceed short positions, longs periodically pay "funding fees" to shorts, and vice versa. As the short side, Resolv can usually continue to collect funding fees in a crypto market that is bullish, which is its core source of income.
[Note 4] Junior Tranche: In a financial tiered structure, junior tranche investors are the first to suffer losses when they occur (equating to the "first loss person"), but they can also receive a higher risk premium compensation during profit distribution. RLP corresponds to the junior tranche of the Resolv protocol, while USR corresponds to the senior tranche.
[Note 5] 110% collateralization rate trigger line: i.e., the total value of USR's collateral assets is 1.1 times the total circulation of USR. Below this line, RLP redemption is suspended to ensure remaining assets are prioritized for USR holders' redemption.
[Note 6] Flash Loan: A unique uncollateralized borrowing tool in DeFi, requiring that the borrowing and repayment occur within the same transaction (same block). Attackers can temporarily acquire large amounts of funds to manipulate prices, as long as they repay before the transaction ends, with almost no funding cost.
[Note 7] Death Spiral: A self-reinforcing collapse during deleveraging: asset prices fall → triggering liquidation → more assets are sold → prices fall further → triggering more liquidations, and so on.
[Note 8] Impermanent Loss: A unique risk faced by automated market maker (AMM) liquidity providers. When the price ratio of two assets in a pool deviates from its initial state, the LP's asset combination value will be lower than the value of directly holding the two assets, with this difference being the impermanent loss.
[Note 9] D2 Finance / CoinTelegraph analysis, citing D2 Finance comments: "Either the oracle was gamed, the off-chain signer was compromised, or the amount validation between request and completion is simply missing." Same source.
[Note 10] CoinTelegraph reported that USR had a 24-hour trading volume of $3.6 million in the Curve USR/USDC pool, with the price dropping to 2.5 cents at 2:38 UTC.
[Note 11] PeckShield estimated data, cited from CoinTelegraph: "PeckShield estimated that the attacker was able to extract around $25 million from the attack amid USR's depeg."