The Resolv USR Exploit Explained

Video transcript

Attackers minted 80 million unbacked USR and took about 25 million dollars. They went around Resolv's audited contracts, through a contractor, a CI pipeline and the cloud.

A contractor's GitHub credential gave attackers a foothold. A malicious workflow stole credentials that led into Resolv's cloud, where they edited the minting key's policy to grant themselves signing authority.

The contract only checked for a valid signature. Rekt says the key needed no multisig and faced no onchain ceiling.

Two deposits of 100,000 USDC each minted 80 million USR, per Rekt. Within 17 minutes, USR traded at two and a half cents on Curve.

The second mint landed about 80 minutes after the first. Attackers were last seen active at 5:15 UTC, one minute before the pause.

Resolv's monitoring flagged the first mint. Resolv first had to find how attackers got signing rights, and Rekt says assembling multisig signatures to pause took about three hours.

Cap mints in the contract itself, check each signed mint against its deposit, alert on key policy changes, keep CI credentials away from signing, and time a pause drill.

Guardian's Automation Pentest tests what each automated key can call and what limits it. The Infrastructure Pentest asks whether a compromised pipeline can sign. Managed Security watches every block and supports automated pauses.

Read the full breakdown, or talk to Guardian about testing the keys that can mint.

In March 2026, one way to mint Resolv's USR stablecoin took two steps. A user deposited collateral through the Counter contract. An authorized offchain service then confirmed the parameters and set how much USR was issued.

Resolv says minting relied on those offchain controls. No independent onchain check constrained the result.

Resolv's security page lists audits of its contracts from 2024 to January 2026. This attack went around the contracts: through a contractor, a CI pipeline and the cloud.

What Happened

Resolv published its post-mortem on April 4, 2026. It says the attack chain began at a third-party project that a Resolv contractor had contributed to.

From there, attackers obtained a GitHub credential tied to the contractor's account. It had broad permissions and gave them "an initial foothold into Resolv's code repositories."

How that upstream project was compromised is still under investigation, Resolv says.

They deployed a malicious workflow "designed to exfiltrate sensitive credentials without triggering outbound network traffic detection," Resolv says. Then they removed their own access.

One control held. Merges to the production branch needed manual approval, so the attackers could not push malicious code to production this way.

The stolen credentials led somewhere else: Resolv's cloud. "Over the following days," the attackers enumerated services there.

How the Attack Worked

The key policy

The minting key sat in the cloud provider's key management service. Signing needed identity-level permissions and a separate key-level access policy to line up, Resolv says.

Several escalation attempts failed. Then the attackers used a higher-privileged role's policy management rights to edit the key's access policy and grant themselves signing authority.

The mint

Rekt identifies the key as the holder of SERVICE_ROLE, which finalizes swap requests. It had held that role since May 2024.

The contract checked that a valid signature existed. Rekt says the key needed no multisig and faced no onchain ceiling.

• Mint one: 100,000 USDC deposited, 50 million USR minted (Rekt).
• Mint two: another 100,000 USDC, 30 million USR (Rekt).
• Exit: hundreds of DEX swaps across several wallets turned USR into ETH (Resolv).

Within 17 minutes of the first mint, USR traded at $0.025 on Curve, Rekt reported.

Timeline and Loss

Times are UTC on March 22, 2026, from Resolv's post-mortem.

The loss, with each figure attributed:

• Minted: 80 million unbacked USR (Resolv).
• Extracted: about $25M in value, as ETH (Resolv). Rekt traced 11,408 ETH, about $24.3M, to one wallet.
• Neutralized: about 46M USR, through burns and blacklisting after a timelock (Resolv).
• Lenders: Rekt reports bad debt at markets that took USR as collateral. Fluid faced over $11M in potential bad debt.
• Holders: in April, Resolv said pre-exploit holders were being compensated 1:1. Its recovery portal closed on September 27, 2026.

What It Shows

A signature is not a limit

The contract asked whether a mint was signed. As Rekt put it, it "didn't ask whether the numbers made sense."

Resolv's own fixes start there: onchain mint caps and oracle-based price validation for minting. Our guide to infinite mint attacks covers the controls that bound a key-based mint.

CI credentials reached the signer

A contractor's credential led to CI, CI to the cloud, and the cloud to the key policy.

Resolv has banned personal access tokens across its GitHub organization. It plans to replace CI/CD credentials with OIDC or equivalent authentication.

The tj-actions compromise is another case of CI secrets reaching far past the build.

Detection was not the bottleneck

Resolv says its real-time monitoring flagged the first anomalous transaction and raised an alert. It does not give the alert's time.

The second mint still landed about 80 minutes after the first. The attackers were active as late as 05:15, one minute before the pause.

Resolv says containment first required finding how the attackers had obtained signing authority. Rekt reports that assembling the multisig signatures to pause took about three hours.

Resolv's fix list includes automated emergency pauses connected to real-time monitoring. Our time-to-detection report found multisig coordination was a recurring delay across incidents.

Checks to run

• List every offchain key that can mint, and what limits it onchain.
• Cap mints per transaction and per period in the contract itself.
• Check each signed mint against the deposit it claims to match.
• Alert on any change to a signing key's access policy.
• Keep CI credentials out of every path that reaches signing.
• Let a single pauser stop minting; keep unpausing on a multisig.
• Run a pause drill and time it, from alert to onchain pause.

How Guardian Tests Minting Signers

Guardian's Offchain Automation Pentest covers keepers, relayers, bots and threshold signers, the systems that "use real privileges unattended." A minting service is one of them.

Three parts of its scope match this incident:

• Bot and keeper privileges: what each automated key can call, whether the contract limits it, and the ceiling on one run.
• Data pipelines: where signed numbers come from, how they are validated, and whether a manipulated source reaches the chain.
• Failure behavior: whether a stuck or spammed job halts safely, and how an operator steps in mid-incident.

The review starts from what the automation must guarantee. Source code access is required.

The path to the key falls under the Infrastructure Pentest: IAM and trust policies, secrets handling, and whether a compromised pipeline can ship or sign.

After launch: response

Guardian's Managed Security page lists Resolv among recent losses as "Out before the pause." Resolv's own timeline bears that out.

Managed Security monitors contracts on every block, including privileged calls, role changes and large fund movements. Its monitoring supports custom actions, including automated pauses.

A Guardian engineer responds to every alert, onchain and offchain, with a 15-minute SLA on Critical alerts.

Frequently Asked Questions

What happened in the Resolv exploit?

On March 22, 2026, attackers who had gained signing rights over Resolv's minting key minted 80 million unbacked USR in two transactions. They extracted about $25M as ETH before Resolv paused its contracts at 05:16 UTC, per its post-mortem.

How did attackers get Resolv's minting key?

Via a third-party project a Resolv contractor had worked on. A credential tied to the contractor's GitHub account let them deploy a workflow that took credentials. In Resolv's cloud, they then edited the key's access policy, Resolv says.

Why did the contract allow an 80 million USR mint?

It checked only for a valid signature from the minting service. Resolv says the mint amount was controlled offchain, and nothing onchain constrained it. Its fixes add onchain mint caps and oracle-based price validation.

Were USR holders repaid?

Resolv's post-mortem says holders from before the exploit were being compensated 1:1, with most redemptions processed. Its Q3 2026 report says the recovery portal closed on September 27, 2026, after a one-month extension.

Sources

• Resolv: Resolv Postmortem, March 22, 2026 Incident (April 4, 2026)
• Resolv: Resolv Foundation, Q3 2026 Report (October 26, 2026)
• Resolv docs: Security (accessed November 6, 2026)
• Rekt: Resolv Labs, Rekt (April 7, 2026)
• Guardian: Offchain Automation Pentest
• Guardian: Cloud and Infrastructure Penetration Testing
• Guardian: Managed Security
• Guardian: Guardian Announces Managed Security