Resolv Labs: contractor’s GitHub credential led to cloud takeover and an unbacked USR mint

What happened

• From 01:50:59 UTC 22 Mar 2026: about 80M unbacked USR minted against about USD 100K to 200K of deposits, about USD 25M to 26.8M extracted (CertiK). USR fell to about USD 0.03 at the low.
• Root cause per CertiK: compromise of cloud infrastructure gave access to AWS KMS and the SERVICE_ROLE signing key; the contract had no maximum mint. Per Resolv’s post-mortem as summarized by Rekt: attackers compromised a third-party project where a contractor had worked, took a GitHub credential, used a malicious CI/CD workflow to exfiltrate cloud credentials, then used a higher-privileged role’s policy permissions to grant themselves signing on the minting key.
• Attribution: none. Mandiant and ZeroShadow investigating.
• Response: protocol paused, SERVICE_ROLE revoked. About 46M of the 80M USR removed by burns and blacklisting by 26 Mar. Pre-exploit holders compensated 1:1.

Sources

• https://www.certik.com/blog/resolv-protocol-incident-analysis
• https://alpha.rekt.news/resolv-labs-rekt
• https://www.halborn.com/blog/post/explained-the-resolv-hack-march-2026

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.