An attacker exploited a broken minting function in Resolv Labs smart contract, minting $80 million in unbacked USR tokens and converting them into approximately 9,100 ETH. USR crashed from its $1.00 peg to $0.025 within minutes. The attacker extracted an estimated $25 million before the protocol’s circuit breakers activated and paused all operations.
Resolv Labs confirmed the incident shortly after:
We are currently investigating a security incident involving unauthorized minting of USR.
At this stage:
The collateral pool remains fully intact. No underlying assets have been lost.
The issue appears isolated to USR issuance mechanics.
Our immediate priority is to:
1)…
— Resolv Labs (@ResolvLabs) March 22, 2026
As of writing USR trades at $0.38, down 62% on the day. Market cap has collapsed to $71 million. Volume spiked 52,364%. The 68,000 holders who owned a dollar-pegged asset this morning are sitting on 38 cents. Resolv Labs says the collateral pool is intact. That statement means nothing to anyone who already sold at a loss.
Resolv USR price chart showing the 62% crash from its $1.00 peg on March 22, 2026. Source: CoinMarketCap
The exploit was not sophisticated. Security firm Cyvers identified the cause as a broken minting function:
🚨 $80M Stablecoin Exploit, and a reminder of how fragile this model really is
Stablecoins don’t fail gradually, they fail all at once.
Today, Cyvers detected a major incident at @ResolvLabs, where an attacker minted ~80M unbacked $USR. No collateral was drained, this was pure…
— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) March 22, 2026
Cyvers called it “gross architectural negligence rather than advanced cryptographic warfare.” The contracts had been audited. The flaw survived the audit anyway.
The Worst Possible Timing
The GENIUS Act was signed into law on July 18, 2025. Congress called it the most significant digital asset legislation in US history. It was specifically designed to prevent unbacked stablecoins from being minted and dumped on retail holders, requiring one-to-one reserves, licensing, and audit standards for stablecoin issuers.
USR falls outside the GENIUS Act’s definition of a payment stablecoin. DeFi protocols like Resolv sit in a regulatory gap the law acknowledged but deferred, directing the Treasury to study and report back within one year. That year is not up. The implementing regulations are not due until July 2026.
Congress wrote a law for the stablecoins they could regulate. The ones they could not regulate just reminded everyone why the law was necessary. Every retail investor waking up to 38 cents on the dollar this morning is a datapoint that opponents of crypto legislation will use in the next congressional hearing.
The industry spent years arguing stablecoins were safe enough for mainstream adoption. The GENIUS Act was the proof. What happened to USR this morning is the rebuttal.
