The Resolv USR Stablecoin Exploit: How a Compromised Off-Chain Signer Let an Attacker Mint 80M Unbacked Tokens and Steal $25M

TL;DR On March 22, 2026, an attacker exploited Resolv Labs' USR stablecoin by compromising the off-chain signing infrastructure that authorized minting. With a $200K USDC deposit, they minted ~80 million unbacked USR tokens, swapped them across DEXes, and walked away with ~$25M in ETH. USR de-pegged to $0.025. The root cause wasn't the delta-neutral strategy — it was a missing on-chain mint cap combined with single-point-of-failure key management . This article breaks down the attack step-by-step, reconstructs the vulnerability, and provides concrete defense patterns every stablecoin protocol should implement. The Protocol: Resolv Labs and Delta-Neutral USR Resolv Labs built USR as a delta-neutral stablecoin — maintaining its peg through hedged positions rather than pure overcollateralization. The architecture: Collateral Deposit : Users deposit USDC/USDT into the protocol Off-Chain Oracle + Signer : An off-chain service calculates the appropriate USR mint amount based on hedging posit