
Floyds4thPig
841 posts





🚨 @ResolvLabs USR just got exploited: here's the full on-chain breakdown h/t @yieldsandmore who flagged this first | data via @ArkhamIntel An attacker deposited 100K USDC into Resolv's USR Counter contract via requestSwap and received 49,950,000 USR back (~$39M) That's a 500× overcredit on a $100K deposit. The minting function is broken. On-chain receipts: → 100,000 USDC sent to Resolv: USR Counter (0xa27a...5861) → 50,000,000 USR minted from null address to Counter → 49,950,000 USR forwarded to attacker (0x04A288a7...caEd) → 100,000 USDC sent to intermediary (0xacB7027f...2b8e) The _targetAmount in the input data reads: 50,000,000,000,000,000,000,000,000 (50M × 10^18) The requestSwap → completeSwap is a 2-step async process. Either the oracle was gamed, the off-chain signer was compromised, or the amount validation between request and completion is simply missing. The attacker's exit playbook is textbook DeFi hack cashout running at full speed: Step 1 — Wrap USR → wstUSR to access deeper DEX liquidity 20M USR → 17.65M wstUSR 15M USR → 13.24M wstUSR Step 2 — Dump wstUSR across every available venue 8.77M wstUSR → 9.7M USDT (KyberSwap) 2M wstUSR → 2.01M USDC (direct contract 0x04a2...caed) 1.31M wstUSR → 655K USDT (KyberSwap) 1.31M wstUSR → 148K USDT (KyberSwap — slippage getting brutal) 604K wstUSR → 568K USDT 300K wstUSR → 277K USDC (Velora) 300K wstUSR → 303K USDC (Velora) Dozens of 100K-150K wstUSR clips through Velora at varying slippage Step 3 — Convert stables → ETH aggressively 4.85M USDT → 2,297 ETH (contract 0xbeef...c555) 1.66M USDT → 789 ETH (Uniswap V4) 2.02M USDC → 948 ETH (MetaMask Swaps) 1.5M USDT → 703 ETH (MetaMask Swaps) 2M USDT → 938 ETH (MetaMask Swaps) 808K USDT → 384 ETH 760K USDT → 362 ETH 656K USDT → 312 ETH 370K USDT → 174 ETH Yes @MetaMask Swaps for multi-million dollar legs 😅 wstUSR selling at $0.50-$0.88 on the dollar across different trades, with slippage worsening as liquidity drains. Multiple failed transactions visible on-chain showing the urgency. Estimated total extraction: $25M+ and counting. The attacker is still actively dumping remaining wstUSR positions as of this post. For context Resolv had ~$500M+ TVL, an @immunefi bug bounty of $500K, Fireblocks custody integration, and multiple audits including a Sherlock competition. Audits ≠ security. Monitoring partnerships ≠ prevention. The core question: how did a 100K USDC requestSwap get authorized as a 50M USR completeSwap? Someone needs to explain what happened between those two steps. @PeckShieldAlert @peckshield @SlowMist_Team @hypaboreal you may want to take a look 👀





productive TVL > $600m these are assets actually being used in DeFi on katana. contributing to the health, resilience, and growth of the ecosystem.








Get ready to join the Booster Program with @turtledotxyz on #Binance Wallet! 📅 Start Time: September 30, 2025, at 10:00 (UTC). 🎯 Eligibility: Users with 61 or above Binance Alpha Points 🎁 Rewards: 15,000,000 TURTLE ⚠️ Important Note: Tokens from the Booster Program are subject to a lock-up period set by the project team. Please make sure you understand the risks before participating. More details and the Event Portal will be announced soon on the @BinanceWallet X account — stay tuned! 👉 Check for Details: binance.com/en/support/ann…










