← Resolv USR Stablecoin Minting Exploit (March 2026)reviewed 2026-09-07 · 35 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Resolv USR Stablecoin Minting Exploit (March 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 4unverifiable 1link rot 2partially supported 2confirmed 266 corrections pending · 0 applied
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #7[disputed][awaiting moderator]in the summary
“reported completing over $77 million in phase-one redemptions by late May 2026”
reviewerResolv Foundation reported completing over $77 million in phase-one redemptions by late May 2026The $77M/90%+ redemption figure is drawn from a Phemex article published March 25, 2026 -- about two months before the May 27, 2026 tiered compensation plan announcement. The page conflates the March emergency redemption of whitelisted holders with the later, separate May compensation-plan/Vault Street announcement.Proposed correction (not yet applied)reported completing over $77 million in phase-one redemptions by late March 2026 - #25[disputed][awaiting moderator]in section: Resolv Labs Entity Background
“The company is based in Dubai, United Arab Emirates.”
reviewerResolv Labs is based in Dubai, United Arab EmiratesTwo independent tier-1/tier-2 sources describe Resolv Labs as Abu Dhabi-based, not Dubai-based. No source found corroborates 'Dubai' specifically.Proposed correction (not yet applied)The company is based in Abu Dhabi, United Arab Emirates. - #28[disputed][awaiting moderator]in the timeline
“Resolv Labs founded by Ivan Kozlov, Fedor Chmile, and Tim Shekikhachev in Dubai, UAE.”
reviewerResolv Labs founded by Ivan Kozlov, Fedor Chmile, and Tim Shekikhachev in Dubai, UAE (timeline entry)Same underlying HQ-location error as in sections[7]; both independent sources point to Abu Dhabi, not Dubai.Proposed correction (not yet applied)Resolv Labs founded by Ivan Kozlov, Fedor Chmile, and Tim Shekikhachev in Abu Dhabi, UAE. - #33[disputed][awaiting moderator]in the timeline
“Resolv Labs reports over $77 million redeemed for allowlisted pre-exploit USR holders, representing more than 90% of that group, completing phase one of recovery. Vault Street institutional RWA product line announced.”
reviewerOn 2026-05-27, Resolv Labs reports over $77 million redeemed for allowlisted pre-exploit USR holders (90%+ of that group), completing phase one of recovery, and Vault Street institutional RWA product line announcedThis entry conflates two separate events under one date: the $77M/90%+ redemption milestone (actually reported March 25, 2026) and the Vault Street RWA launch (genuinely late May 2026, per a different Phemex article). The date field should be corrected to 2026-03-25 for the redemption fact; the Vault Street announcement is a distinct, correctly-dated event that should not share this entry.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #24[unverifiable][awaiting moderator]in section: Resolv Labs Entity Background
“Resolv Labs was founded in January 2023 by Ivan Kozlov (Co-Founder and CEO), Fedor Chmile, and Tim Shekikhachev”
reviewerResolv Labs was founded in January 2023The 2023 founding year is broadly corroborated across sources, but no independently accessible source specifies January as the founding month; this specific granularity could not be confirmed.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #34[link rot][awaiting moderator]in section: Protocol Response and Recovery
“https://www.mexc.com/news/981363”
reviewerMEXC News source URL for the $77M redemption / 90% figureThe live URL is dead (410 Gone). An archived snapshot exists in sources_used and should be substituted or added as the primary reference.Proposed correction (not yet applied)https://web.archive.org/web/20260726105305/https://www.mexc.com/news/981363 - #35[link rot][awaiting moderator]in the cited sources
“https://www.mexc.com/news/981363”
reviewerMEXC News source URL for the $77M redemption / 90% figure (sources_used entry)Same link-rot issue as the section-level citation; the sources_used record already has a working archive_url that should become the canonical url.Proposed correction (not yet applied)https://web.archive.org/web/20260726105305/https://www.mexc.com/news/981363
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #22[partially supported][awaiting moderator]in section: DeFi Ecosystem Contagion
“The Resolv incident contributed to total reported 2026 DeFi losses of at least $137 million”
reviewerThe Resolv incident contributed to total reported 2026 DeFi losses of at least $137 millionThe $137M figure is real but is a Q1-2026 cumulative total per the cited source, not a full-year 2026 total; the page's phrasing implies a broader annual scope than the source supports. - #23[partially supported][awaiting moderator]in section: Systemic DeFi Security Context
“Reporting from The Defiant and BlockBeats identified at least four prior incidents following the same structural pattern”
reviewerResolv exploit pattern of over-reliance on a single off-chain privileged key with no on-chain validation is not novel; The Defiant and BlockBeats identified at least four prior incidents following the same structural patternThe 'four prior incidents' statistic is real but is misattributed in this sentence to the minting-key vulnerability; both cited sources' four incidents are actually examples of the hardcoded-oracle contagion pattern described in the following sentence, not the root-cause exploit pattern.
confirmed
26 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“an attacker compromised Resolv Labs' AWS Key Management Service (KMS) infrastructure to steal the SERVICE_ROLE private key controlling the USR minting contract”
reviewerAttacker compromised Resolv Labs' AWS KMS infrastructure to steal the SERVICE_ROLE private key controlling the USR minting contractDirectly confirmed by CertiK's incident analysis, which names the specific compromised EOA and describes the AWS KMS compromise mechanism. - #2[confirmed][no action needed]in the summary
“the attacker deposited approximately $100,000-$200,000 in USDC across two transactions and minted approximately 80 million unbacked USR tokens at a 400-500x over-mint ratio”
reviewerAttacker deposited approximately $100,000-$200,000 in USDC across two transactions and minted approximately 80 million unbacked USR tokens at a 400-500x over-mint ratioFigures match exactly across CertiK's on-chain analysis and independent news reporting. - #3[confirmed][no action needed]in the summary
“ultimately extracting roughly $23-$25 million in ETH”
reviewerAttacker extracted roughly $23-25 million in ETHThe stated range is corroborated and the page appropriately notes the range reflects differing measurement times/ETH prices across outlets. - #4[confirmed][no action needed]in the summary
“The exploit crashed USR's dollar peg by approximately 70-80% within 17 minutes”
reviewerUSR's peg crashed by approximately 70-80% within 17 minutesConfirmed; the 17-minute timeframe to the ~$0.025 trough is independently corroborated. - #5[confirmed][no action needed]in the summary
“created functional insolvency for the Resolv protocol ($95M assets vs $173M liabilities)”
reviewerResolv protocol became functionally insolvent with $95M assets vs $173M liabilitiesCould not directly fetch the primary cited Ainvest article (403 error) but the figure is corroborated via independent search of secondary reporting on the same numbers. - #6[confirmed][no action needed]in the summary
“spread cascading losses across at least 15 Morpho vaults and Fluid/Instadapp lending markets”
reviewerCascading losses spread across at least 15 Morpho vaults and Fluid/Instadapp lending marketsDirectly confirmed. - #8[confirmed][no action needed]in the summary
“The Resolv Foundation subsequently launched a tiered compensation plan in late May 2026”
reviewerThe Resolv Foundation launched a tiered compensation plan in late May 2026This specific claim (the compensation plan itself, as distinct from the $77M redemption figure) is correctly dated to late May 2026. - #9[confirmed][no action needed]in section: Incident Overview and Figure Disambiguation
“In the first transaction, the attacker deposited approximately 100,000 USDC into Resolv's USR Counter contract (0xa27a69Ae180e202fDe5D38189a3F24Fe24E55861) and received 50 million USR in return”
reviewerFirst minting transaction deposited ~100,000 USDC and minted 50 million USR via tx 0xfe37f25e at 02:21 UTCExact match to CertiK's on-chain transaction table. - #10[confirmed][no action needed]in section: Incident Overview and Figure Disambiguation
“the primary attacker-linked wallet (0x8ED8cF0C1c531C1b20848E78f1CB32fa5b99b81C) held approximately 11,408.85 ETH (roughly $24.78 million) plus approximately $1.1 million in wrapped staked USR (wstUSR)”
reviewerAttacker wallet 0x8ED8cF0C1c531C1b20848E78f1CB32fa5b99b81C held approximately 11,408.85 ETH (~$24.78 million) plus ~$1.1 million wstUSR as of March 24, 2026Wallet address and approximate holdings are confirmed by an independent source using the same wallet identifier. - #11[confirmed][no action needed]in section: Technical Root Cause: Unchecked Mint and Single-Key Architecture
“the minting contract's completeSwap() function enforced a minimum USR output but imposed no maximum output limit, no price oracle check, and no ratio validation between collateral deposited and USR to be minted”
reviewercompleteSwap() enforced a minimum USR output but no maximum output limit, oracle check, or ratio validation; SERVICE_ROLE was a single EOA rather than a multisigTechnical root-cause description matches CertiK's analysis verbatim in substance. - #12[confirmed][no action needed]in section: Technical Root Cause: Unchecked Mint and Single-Key Architecture
“the SERVICE_ROLE — the off-chain signing key authorizing mint requests — was assigned to a single externally owned account (EOA) wallet (0x15CAd41e6BdCaDc7121ce65080489C92CF6de398) rather than a multisignature wallet”
reviewerSERVICE_ROLE key was assigned to EOA 0x15CAd41e6BdCaDc7121ce65080489C92CF6de398Confirmed exact address match. - #13[confirmed][no action needed]in section: Infrastructure Compromise Vector
“Threat intelligence firms including Recorded Future and eSentire reported that the Interlock ransomware group had been exploiting this zero-day since approximately January 26, 2026 — 36 days before Cisco issued a patch on March 18, 2026”
reviewerCVE-2026-20131 is a critical (CVSS 10.0) Cisco Secure FMC zero-day exploited by Interlock ransomware group since approximately January 26, 2026, 36 days before a March 18, 2026 patchWell-supported by two independent, live sources plus AWS's own threat intelligence blog found via search. - #14[confirmed][no action needed]in section: Infrastructure Compromise Vector
“The direct link between the Interlock group and the Resolv Labs breach has not been officially confirmed by Resolv or law enforcement as of the time of publication; this attribution is assessed as alleged and sourced from infrastructure security analysts”
reviewerThe direct link between Interlock and the Resolv Labs breach is alleged, not officially confirmedThe page's hedging accurately reflects that this attribution is analyst speculation, not an official finding -- this is a correct and important caveat, not an overstatement. - #15[confirmed][no action needed]in section: Attacker Wallets and Fund Flows
“CertiK's incident analysis identified five attacker-linked wallet addresses: 0x04A288a7789DD6Ade935361a4fB1Ec5db513caEd, 0x8ED8cF0C1c531C1b20848E78f1CB32fa5b99b81C, 0x6Db6006c38468CDc0fD7d1c251018b1B696232Ed, 0xb945eC1be1f42777F3AA7D683562800B4CDD3890, and 0x9FeeEAEc113E6d2DCD5ac997d5358eee41836e5f”
reviewerCertiK identified five attacker-linked wallet addresses (list of five given)Exact match, including addresses. - #16[confirmed][no action needed]in section: Attacker Wallets and Fund Flows
“On approximately March 24, 2026, Resolv issued a 72-hour ultimatum to the attacker requesting return of 90% of funds in exchange for keeping 10% as a white-hat bounty”
reviewerResolv issued a 72-hour ultimatum to the attacker on approximately March 24, 2026, requesting return of 90% of funds for a 10% white-hat bountyDirectly confirmed. - #17[confirmed][no action needed]in section: Market and Price Impact
“Within 17 minutes of the first minting transaction, USR's price on its most liquid Curve Finance pool crashed from $1.00 to approximately $0.025”
reviewerUSR crashed from $1.00 to approximately $0.025 within 17 minutes, recovered to ~$0.85, then stabilized around $0.27 -- a ~72% weekly declineConfirmed by independent research source in addition to the cited news articles. - #18[confirmed][no action needed]in section: Market and Price Impact
“Resolv's total value locked had already contracted approximately 75% over the preceding six weeks, falling from a peak of roughly $400-$684 million (figures vary by source and measurement period) to approximately $100 million”
reviewerResolv's TVL had contracted ~75% over the preceding six weeks, from a peak of $400-684 million to ~$100 million prior to the exploitThe range given is wide but appropriately hedged as varying by source; independent verification supports the range rather than a single precise figure. - #19[confirmed][no action needed]in section: DeFi Ecosystem Contagion
“Fluid (formerly Instadapp) absorbed more than $10 million in bad debt and experienced outflows exceeding $300 million in a single day, described as the worst single-day outflow in Fluid's history”
reviewerFluid absorbed more than $10 million in bad debt and experienced $300M+ outflows in a single day, its worst single-day outflowDirectly confirmed. - #20[confirmed][no action needed]in section: DeFi Ecosystem Contagion
“Approximately $6.2 million in USDC was drained from Morpho vaults by this mechanism; approximately $6 million of this total came from Gauntlet-managed vaults”
reviewerOracles hardcoded wstUSR at $1.00; approximately $6.2 million in USDC was drained from Morpho vaults, ~$6 million from Gauntlet-managed vaultsConfirmed, with the 96%-of-$6.2M figure matching the page's 'approximately $6 million' framing. - #21[confirmed][no action needed]in section: DeFi Ecosystem Contagion
“Euler, Venus, Lista DAO, and Inverse Finance moved to pause USR-related markets preemptively. Aave confirmed zero USR exposure.”
reviewerEuler, Venus, Lista DAO, and Inverse Finance paused USR-related markets preemptively; Aave confirmed zero USR exposureBoth halves of the claim are independently corroborated, though the Aave detail is not directly traceable to any of the section's four cited sources -- it appears to be sourced elsewhere. - #26[confirmed][no action needed]in section: Resolv Labs Entity Background
“Kozlov holds degrees in Applied Mathematics and Physics from the Moscow Institute of Physics and Technology (MIPT) and a background in derivatives structuring at VTB Capital and FG BCS, which he has cited as the basis for the protocol's structured-product architecture”
reviewerKozlov holds degrees in Applied Mathematics and Physics from MIPT and a background in derivatives structuring at VTB Capital and FG BCSConfirmed via independent search corroboration of Kozlov's professional background. - #27[confirmed][no action needed]in section: Resolv Labs Entity Background
“In April 2025, Resolv Labs raised a $10 million seed round led by Cyber.Fund and Maven11, with participation from Coinbase Ventures, SCB Limited, Arrington Capital, Animoca Ventures, Gumi Cryptos, NoLimit Holdings, and Robot Ventures”
reviewerIn April 2025, Resolv Labs raised a $10 million seed round led by Cyber.Fund and Maven11, with the listed participantsConfirmed via independent corroboration; CoinDesk itself was rate-limited (429) on direct fetch but the facts are widely corroborated. - #29[confirmed][no action needed]in the timeline
“SERVICE_ROLE assigned to externally owned account wallet 0x15CAd41e6BdCaDc7121ce65080489C92CF6de398 — the key later compromised in the attack.”
reviewerSERVICE_ROLE assigned to EOA 0x15CAd41e6BdCaDc7121ce65080489C92CF6de398 on 2024-12-26Exact date and address match CertiK's analysis. - #30[confirmed][no action needed]in the timeline
“At 01:50 UTC, attacker submits swap request transaction (0x590b5c66) depositing approximately 100,000 USDC into the USR Counter contract.”
reviewerAt 01:50 UTC on March 22, 2026, attacker submits swap request transaction 0x590b5c66 depositing ~100,000 USDCExact match (page truncates the tx hash but it corresponds to CertiK's fuller hash). - #31[confirmed][no action needed]in the timeline
“At approximately 04:21 UTC, second minting transaction (tx: 0x41b6b937) mints an additional 30 million USR. Total unbacked supply reaches approximately 80 million USR.”
reviewerSecond minting transaction (0x41b6b937) at ~04:21 UTC mints an additional 30 million USR, bringing total to ~80 millionConfirmed. - #32[confirmed][no action needed]in the timeline
“Resolv Labs publicly confirms the exploit. Protocol burns approximately 9 million USR from the attacker's account. Protocol reports functional insolvency: $95M assets vs $173M liabilities.”
reviewerOn March 23, 2026, Resolv publicly confirms the exploit, burns ~9 million USR, and reports $95M assets vs $173M liabilities9M USR burn figure confirmed by Decrypt; insolvency figures confirmed via independent search corroboration.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.