A major cyberattack has rocked the cryptocurrency market, sending shockwaves through decentralized finance as Resolv Labs’ USR stablecoin lost its dollar peg. The incident highlighted significant vulnerabilities in DeFi protocols, underscoring that even after rigorous audits, these systems can remain susceptible to exploitation.
How the Attack Unfolded
USR, developed by Resolv Labs—a rising name in decentralized finance projects—saw its value plummet in the wake of a sophisticated breach. Blockchain data reveals that the attacker initiated the exploit by depositing roughly $200,000 in USDC, setting the stage for a much larger manipulation. With this modest stake, the perpetrator managed to mint 80 million USR tokens—creating new coins without sufficient collateral to back them within the protocol.
Investigation points to a fundamental flaw in the token-minting operations. Security gaps in the “requestSwap” and “completeSwap” functions enabled the attacker to circumvent critical safeguards and exploit open limits in the protocol for personal gain.
The Resolv Labs team announced that, following the breach, they had immediately suspended all operations and begun work on repairs.
The Strategy That Undermined the System and Sparked a Price Crisis
Rather than offload the large volume of USR tokens directly onto the market, the attacker converted them into a staked version called “wstUSR,” which functions differently within liquidity pools. By taking this approach, the perpetrator distributed the tokens across various platforms, introducing them in ways that gradually destabilized available liquidity.
Subsequently, the attacker exchanged these assets for other stablecoins and Ethereum, culminating in a hoard estimated at 11,400 Ethereum and around 20 million wstUSR. The market soon felt the impact: Thin liquidity, coupled with aggressive token sales, caused the USR price to crash by almost 80 percent, plunging to roughly $0.05. The dramatic plunge deeply rattled user confidence and cast doubt over the stability of the system.
Audits Failed to Spot Key Vulnerabilities
It has emerged that Resolv Labs was subjected to 18 separate audits before the attack and that its smart contracts underwent numerous security checks. A December 2024 audit flagged five different issues, including a critical flaw in the fee calculation function. Additionally, the audits detected missing upper-limit controls in certain features, although no security risks were noted in the main administrative functions directly involved in the attack.
Analysts emphasized that, all too often, privileged admin functions escape full scrutiny during audits, and loopholes within central control mechanisms can go unchecked.
Security experts explain that most audit processes focus on code accuracy, but fail to assess the systemic risks posed by centralized permissions. They note that such gaps are frequently overlooked, leaving the door open for precisely this kind of sophisticated exploitation.
Reserves Remain Intact as Uncertainty Looms
In the aftermath, the Resolv Labs protocol remains completely frozen. Initial assessments suggest that user funds secured in the protocol’s reserve pools have not been compromised. While USR’s supply was manipulated during the attack, the assets held in reserve appear, for now, to be unaffected.
Nevertheless, the steep decline in USR’s value and mounting concerns around trust have fueled a fresh crisis for Resolv Labs. All eyes are now on how the team will navigate these turbulent waters and restore both operational normalcy and user confidence.
