bitcoinearly
8.3K posts







I traced the Resolv $USR exploiter's full funding chain onchain. The root wallet behind the $25M hack was seeded directly from @Binance. They have KYC on this person. Tagging @zachxbt because this rabbit hole goes deeper than just Resolv 🧵 (sorry for the tag bro) (1/4)






When we built Neutrl, we looked at how others in the space structured the issuance and redemption of their stablecoins. A common pattern: off-chain systems where a backend server signs orders, sets the price, and decides how much stablecoin you get for your collateral. The problem? If that server or signer key gets compromised, someone can mint millions of stablecoins out of thin air for pennies. We've seen it happen. We weren't comfortable with that. We believe well-designed smart contracts are harder to compromise than web2 infrastructure — servers get hacked, keys get leaked, infra goes down. So we went fully on-chain. When you mint NUSD, the contract queries Chainlink oracles directly at execution time, wrapped in the Euler ERC-7726 standard for additional safety checks. No backend decides your quote. No off-chain signer involved. There's no privileged role that can dictate how much NUSD gets minted for a deposit — the oracle gives the price, the contract does the math, that's it. We also don't blindly trust whatever the oracle returns. If the price of a collateral drops below a threshold we've set, the transaction reverts. We'd rather block a mint than risk giving someone a bad quote. But on-chain design alone isn't the full picture. Defense in depth matters. We use @HypernativeLabs for real-time threat monitoring — they are one of our pauser role on our contracts and can freeze operations the moment something looks off. tl;dr how we think about security at Neutrl: oracle pricing on-chain with no off-chain signers to compromise, price bounds that revert instead of giving bad quotes, per-block limits enforced in the contract, and Hypernative watching 24/7 with the ability to pause.




We are currently investigating a security incident involving unauthorized minting of USR. At this stage: The collateral pool remains fully intact. No underlying assets have been lost. The issue appears isolated to USR issuance mechanics. Our immediate priority is to: 1) Contain the incident 2) Assess impact 3) Ensure legitimate users are not affected We are actively investigating and will share more updates shortly.




