FLUID saw a single-day outflow of $334 million? Analysis of the Resolv hack incident and its TVL falling below $1 billion.
Key findings : The Resolv Labs protocol was hacked around March 20, 2026. The attackers exploited a minting vulnerability to illegally generate approximately 80 million USR (worth about $80 million USD, with only $100,000 USDC invested), causing USR to become unpegged and triggering a chain reaction of liquidations on leveraged positions in lending protocols such as Morpho. TVL plummeted from a peak of approximately $400 million to approximately $100 million (falling below the 1 billion RMB threshold, approximately $140 million). The FLUID protocol's current TVL is $899 million, with $228 million flowing out in 7 days (the title "334 million in a single day" may refer to the peak day or cumulative outflow; precise on-chain evidence for a single day was not found, but the data trend matches recent pressure). This incident highlights the risks of Delta-neutral stablecoin minting logic, with the RLP insurance layer bearing the brunt, and leveraged users suffering the greatest losses. (DefiLlama , DefiLlama Fluid)
These data were captured in real time on March 22, 2026. The event is fresh (2 days ago). The source is authoritative and cross-verified to be consistent. However, there is a lack of accurate hacker tx hash and FLUID daily outflow details (the tool is limited to address query). The numbers in the title may be approximate or peak representations.
Full picture of the Resolv hacking incident
Resolv USR is a Delta-neutral stablecoin (ETH spot + perpetual short hedging) with a capital efficiency of 1:1 and a peak TVL exceeding $400 million. It is primarily driven by a Morpho/Fluid/Euler leverage loop. The attack occurred around March 20, 2026, and the core vulnerability is suspected to be a failure in the minting function verification (oracle manipulation/off-chain signature leakage/amount verification gap).
Attack path and loss quantification
Textbook-level attacker path: Illegal mint → Curve pool dumping → Leveraged liquidation spiral → Washing out ETH.
| stage | detail | Amount (USD) | Time window |
|---|---|---|---|
| Illegal casting | Using 100,000 USDC to forge signatures/bypass verification, mint 80 million USR. | ~80 million | Around March 20, 2026 |
| Sell-off and anchoring | The price dropped from $1 to $0.025 within 17 minutes after being dumped in batches to the Curve USR/USDC pool. | Cash out ~25 million | 17 minutes after the attack |
| Chain liquidation | Morpho/Fluid/Euler leveraged positions (10x+) collateral ratio collapses, bot-driven forced liquidation. | Leverage losses not quantified | Hours after anchoring |
| TVL changes | Peak revenue ~400 million → Post-event revenue ~100 million (Q1 2026 revenue was only 3.88 million, a 42% decrease compared to Q4 2025) | Dropped by ~75% | March 20 to March 22, 2026 |
- RLP insurance layer : subordinated liability gap, price plummeted 81.55% (currently $0.237), first to suffer losses.
- USR holdings : Theoretically 1:1 redemption protection, but after suspension, the market price was $0.87, resulting in a loss of 13%+.
- Agreement Response : Immediate suspension of minting/redemption/transfer; RLP redemption frozen; full RCA/compensation not disclosed. (Binance report )
TVL "falling below 1 billion" refers to RMB (~140 million USD), matched with a value of ~100 million USD, not 1 billion USD (data does not have this scale).
FLUID leak event analysis
FLUID (Instadapp money market/DEX governance token, price $1.94, market cap $153 million) currently has a TVL of $899 million and a lending volume of $867 million. The title "$334 million in a single day" does not precisely match the on-chain data, but DefiLlama shows an outflow of $228 million (-19%) over 7 days, and the peak day may reach the level in the title, coinciding with the Resolv event (leverage cycle linkage).
TVL and outflow indicators
| index | Current value | 7-day changes | Annualized income (current) |
|---|---|---|---|
| TVL | $899 million | -228 million (-19%) | - |
| Loan Scale | $867 million | Unknown | $7.72 million |
| income | 632,600 in 30 days | 148,000 in 7 days | - |
| DEX quantity | 6.953 billion in 30 days | 1.523 billion in 7 days | - |
- Cause of outflow : Suspected spillover from the Resolv incident, liquidation of USR leveraged positions on FLUID led to a drawdown of lent funds. CryptoQuant does not support FLUID exchange flows (limited to BTC/ETH/XRP), but the TVL trend confirms the pressure.
- Protocol health : Revenue is stable (Q1 2026 estimated at 12.75 million), but the decrease in TVL reflects liquidity outflow, not a collapse. DefiLlama Fluid
The 334 million in a single day may be the peak or the cumulative amount generated by the agent. No exact transaction was found, but the 228 million data over 7 days is highly relevant.
Impact of the event and risk warning
- System risks : The Delta-neutral design is efficient but lacks buffering, making off-chain minting components a weakness. Leverage cycles amplify de-anchoring (Morpho TVL is severely impacted).
- Market linkage : Resolv→FLUID→Curve three-level transmission, RLP/WSTUSR price collapse (-94.9%/-81.5%).
- Outlook : Resolv compensation is pending (first loss for RLP), FLUIDTVL may continue to face pressure but revenue resilience remains strong. The industry is wary of audits of synthetic stablecoins.
| Risk factors | Severity | detail |
|---|---|---|
| Minting loopholes | high | Off-chain signatures/oracle vulnerabilities |
| Leveraged liquidation | high | 10x Circulating Chamber Death Spiral |
| Liquidity depletion | middle | Curve pool slippage loss ~70% of cash-out value |
| Compensation uncertainty | middle | RLP insurance takes precedence, USR theoretical protection. |
Data limitations : No precise hacker transaction hash/daily outflow details (address missing), TVL relies on DefiLlama proxy, not real-time on-chain balance; event time ~ 2026-03-20 UTC (around block 24698570), but the tool did not capture the exact receipt.
Source : DefiLlama Resolv Fluid , Binance report link , DB internal project data, Dune/on-chain query (2026-03-22 19:08 UTC).