Resolv Exploit Update Leaves Key Recovery Questions

• Resolv exploits allowed 80M USR minting, with 98% of whitelisted holder redemptions completed.

• Non-whitelisted and post-exploit users face delays as technical and legal solutions develop.

• No insider evidence found, but recovery for RLP holders remains uncertain without timeline.

Resolv Labs has issued a fresh update after an exploit allowed an attacker to mint 80 million USR tokens using a compromised private key. CEO Ivan Kozlov addressed users this week, outlining redemption progress and ongoing investigations. The incident, first disclosed recently, continues to affect multiple user groups as recovery efforts move forward without a clear timeline.

Redemption Process Moves in Phases

According to Resolv Labs, the team prioritized whitelisted USR holders during the first phase of redemptions. Verified wallets allowed manual processing within 24 hours, helping limit broader market disruption. Kozlov confirmed that about 98% of these redemptions are now complete.

However, non-whitelisted pre-exploit holders remain in a waiting phase. Kozlov said the same 1:1 redemption commitment applies to them. He added that the technical solution for these users is still under development.

At the same time, post-exploit holders, liquidity providers, and RLP participants face a more complex process. Kozlov noted that these cases require coordination across legal, technical, and ecosystem layers. As a result, no single solution has been finalized.

Investigation Finds No Insider Evidence

Meanwhile, questions around insider involvement have drawn attention. Kozlov stated that, so far, investigations have not found evidence of internal wrongdoing. The probe continues with cybersecurity firm Mandiant and blockchain intelligence group zeroShadow.

The attack exploited a private key tied to a privileged minting role. This account lacked multisignature protection and had no on-chain mint cap. As a result, the attacker could authorize large token creation without constraints.

In response, Resolv has engaged legal advisors, including Paul Hastings and Carey Olsen. Kozlov said legal considerations now shape communication, limiting what the team can disclose publicly.

Uncertainty Remains for RLP Holders

Attention has also shifted to RLP token holders, who absorbed initial losses by design. Currently, redemptions for RLP remain paused. Kozlov acknowledged ongoing work on a recovery plan but did not provide details.

Despite earlier investments in audits, monitoring, and bug bounty programs, the incident still occurred. Kozlov admitted these measures proved insufficient in this case.

For now, the recovery process continues without a defined timeline, leaving affected users awaiting further updates.