Resolv Labs

Resolv Postmortem — March 22, 2026 Incident The report covers the multi-stage attack originating outside Resolv’s perimeter, unauthorized access to signing infrastructure, and the resulting mint of 80M USR, along with detection, containment, and remediation actions across infrastructure and on-chain systems. The investigation is ongoing and is being conducted with support from external security firms including Hypernative, Hexens, MixBytes, and SEAL 911, with further assessment planned with Mandiant and ZeroShadow.

Ivan, co-founder of Resolv, has shared an update on the protocol security incident and recovery process. Some of the questions covered: → Why were whitelisted USR users redeemed first? Verified wallets allowed the team to act within 24 hours manually to limit further impact on the broader market. 98% of those redemptions are complete. → What can non-whitelisted pre-exploit USR holders expect? The same 1:1 commitment. The team is finalising the technical solution for redemptions. → Was this an insider incident? The investigation with Mandiant and ZeroShadow is ongoing. No evidence of insider involvement has been found at this stage. → What about post-exploit USR holders, LPs and RLP holders? The remaining steps involve legal, technical, and ecosystem coordination across many counterparties. There is no single obvious solution — only a set of trade-offs. The goal is to find the most balanced outcome. → How long will the full recovery plan take? We are moving as quickly as the process responsibly allows. 🔗Watch the full video on X

Update on illicitly minted USR supply reduction Of the total 80M USR illicitly minted during the exploit on March 22, 2026, approx. 46M (~57%) has been permanently removed from circulation through a combination of burns and blacklisting. As a result, no illicitly minted assets remain on exploiter-associated addresses that could be further transferred or converted. Multiple steps have been taken to reduce the amount of 80M illicitly minted USR: → ~9M USR was burned across two transactions on March 22 • https://etherscan.io/tx/0xecf1f05750038b13a60a3468f716cb130199f55d34917b96d4177748b1486bd7 • https://etherscan.io/tx/0x0d30bee89dd50d59cb3ff75ffbec69bb9e173b6053864cfe71345453601f9aba → Another ~36M USR held by exploiter-associated wallets in a form of wstUSR was blacklisted. This was accomplished via a wstUSR contract upgrade, which required a 72-hour timelock initiation due to contract-level constraints. • https://etherscan.io/tx/0xa1ef88d388b29cbc3e05e89004c992c50184dd8b7c0a748a37c76e7273217313 → Remaining exploiter-held USR has been burned. • https://etherscan.io/tx/0x99c985c75e4453b0cb09b868d08510e5580f94d4c90bd3ff3d30177159dc83b1

Update on Redemption Process Over the past 2 days, $77M+ has been redeemed for allowlisted wallets with pre-exploit USR, representing 90%+ of this group and marking strong progress in phase one of recovery. Next: • Redemption process for this group is actively being completed • Work on subsequent phases, covering remaining user groups

Update on Redemption Process Resolv Digital Assets Ltd. is in contact with all allowlisted users with USR holdings at the time of the incident. As the first recovery step, redemptions for pre-incident USR are now enabled for this group. Updates for other users will follow.

This notice is issued on behalf of Resolv Digital Assets Ltd. in relation to the Resolv protocol. Earlier today, a malicious actor gained unauthorized access to Resolv infrastructure through compromised private key, resulting in the minting of approximately $80M of uncollateralized USR. A full post-mortem is currently in progress and will be shared once completed. The incident was identified quickly, and the relevant smart contracts were promptly paused. Approximately 9M USR held by the attacker has since been burned in order to reduce the potential impact. The protocol currently holds approximately $141M in assets, with the only realized impact identified to date being approximately $0.5M in redemptions processed prior to the pause. Current USR supply consists of 102M pre-incident USR and approximately 71M newly and illicitly minted tokens. As an initial step in the recovery process, we are preparing to enable redemptions for all pre-incident USR, beginning with allowlisted users. The current target start date is 23 March 2026. Affected users should coordinate directly with RDAL through official channels. This incident resulted from unauthorized third-party actions, including a targeted infrastructure compromise and cyberattack. Resolv’s underlying collateral was not directly compromised. We are actively: • tracing and seeking to contain illicitly minted USR and other affected assets • coordinating with partners and counterparties • working with law enforcement and onchain analytics firms to identify those responsible We will pursue all available avenues to recover assets and hold those responsible accountable. We strongly advise against trading USR or related Resolv tokens at this time while recovery measures are being implemented. Actions of users during post-exploit period may affect the recovery. Further updates regarding illicit USR, and RLP will be communicated in the near term.

The previously disclosed exploit involving ~80M unbacked USR remains under active investigation. Until further notice, we strongly recommend avoiding trading or interacting with Resolv assets at this time to prevent supporting secondary market activity related to the exploit.

💙 Resolv is collaborating with Steakhouse as a long-term risk management partner. Institutional-grade assets requires institutional-grade risk processes. This step formalizes how Resolv’s risk framework is reviewed, challenged, and evolved. Why Steakhouse: • Deep expertise in RWAs and asset–liability management, contributing to Grove, Sky protocol's RWA vehicle, and being the largest vault curator on Morpho • Strong alignment with the objective to position USR as a prime asset, built on explicit risk parameters, transparent capital allocation, and disciplined asset-liability management Scope of engagement includes: • Unified risk framework (liquidity, market, concentration, duration) • Independent review of collateral and venue exposure • Transparency & attestation dashboards → The first comprehensive risk report is now live.

Season 4 $RESOLV airdrop claim is live → claim.resolv.xyz🖤 Claim stRESOLV — staking continues to earn protocol rewards. During Season 4, stRESOLV delivered an average ~26% APR supported by ecosystem rewards. Upcoming proposals for partner rewards aim to sustain attractive staking yields. Airdrop allocation: 1.65% of total token supply (TTS) Allocations are based on final points balances. Users with more than 100,000 points receive their allocation according to the following rules: < 50,000 $RESOLV • Full allocation is claimable immediately ≥ 50,000 $RESOLV • 50,000 $RESOLV + 10% of excess claimable immediately • Remaining balance vests via Coinbase Token Manager (formerly Liquifi) Claims deadline: April 5, 23:59 UTC

Season 1 airdrop claim for vested wallets via Coinbase Token Manager (formerly Liquify) will end on 27 March 2026. If you’re eligible and haven’t claimed yet, this is a friendly reminder. → tokenmanager.coinbase.com 10 months after the initial claim date, any unclaimed tokens will return to the Resolv Foundation treasury for future ecosystem initiatives.

Resolv Season 4 Airdrop — Reminder The Season 4 snapshot was taken on February 26 at 23:59 UTC. All points have been finalized, no action required. Airdrop details: • Allocation: 1.65% TTS (proportional to season duration) • Claims open on March 5 and run until April 5. • Rewards distributed in stRESOLV — a transferable, staked token that accrues value and boosts across the ecosystem. • Vesting will apply to top wallets; detailed terms will be announced when claims go live. → Read more about the transition to liquid incentives

💙 Resolv has integrated Janus Henderson’s AAA CLO fund (JAAA) into its yield architecture via Centrifuge and Aave Horizon, with up to $100M allocation. For the first time at this scale, AAA-rated institutional credit is deployed as actively leveraged collateral onchain. JAAA is managed by Janus Henderson (~$27B AAA CLO AUM). Tokenized by Centrifuge in 2025, it has grown to ~$800M onchain through passive RWA allocations. Resolv now deploys it as actively managed collateral under defined LTV parameters within its yield architecture. For Resolv, this strengthens: • collateral quality • rate diversification • capital efficiency → More detailed breakdown and structural characteristics