The Resolv USR Exploit: How a Missing Max-Mint Check Let an Attacker Print $25M From $100K

The Resolv USR Exploit: How a Missing Max-Mint Check Let an Attacker Print $25M From $100K A deep dive into the March 22 Resolv Labs hack — the anatomy of a two-step minting flaw, compromised key infrastructure, and why on-chain guardrails are non-negotiable for stablecoin protocols. TL;DR On March 22, 2026, an attacker exploited Resolv Labs' USR stablecoin minting system by compromising a privileged signing key stored in AWS KMS. Using the requestSwap() → completeSwap() flow, they deposited ~$100K–$200K in USDC and minted 80 million unbacked USR tokens — a 400–500x over-mint. The attacker extracted ~$25M in ETH within 17 minutes, crashing USR from $1.00 to $0.025. The root cause: zero on-chain validation between collateral deposited and tokens minted. The Protocol Design Resolv is a delta-neutral stablecoin protocol. USR maintains its dollar peg through a collateral pool of ETH, staked ETH, and Bitcoin, hedged with perpetual futures. A second token, RLP (Resolv Liquidity Pool), acts a