In January, Webacy introduced real-time depeg and risk detection across our stablecoin universe. In February, we expanded into structural vault risk scoring. In March, the system was tested under real market stress during the USR incident and performed as designed.
On March 22, 2026, Resolv USD (USR) began to collapse. Our system flagged early warning signals hours before the protocol’s official statement, highlighting how quickly structural stress can surface ahead of public communication.
Here is what we observed, and what we learned and improved upon from the incident.
The USR Incident: Key Takeaways
The first warning signal appeared at 02:41 UTC, more than two hours before Resolv Labs’ official statement at 04:58 UTC confirming that a compromised private key had been used to mint approximately $80M in unbacked USR.
Detection Summary
- Time from near-peg to Warning: ≤ 20 minutes
- Time from Warning to Critical: ≤ 20 minutes
- Sustained Critical posture: 10+ hours
- Lowest observed price: ~$0.055 (~94.5% below peg)
The timeline below shows how quickly the system escalated as conditions deteriorated.
Figure 1: Timeline of price, risk score, and escalation across monitoring cycles, showing rapid transition from stable to sustained critical state.
This was a structural failure, not a market-driven depeg. Supply surged while price collapsed, a clear on-chain signature of unbacked minting. By 04:23 UTC, tens of millions of USR had been minted within hours while the token continued to trade far below peg.
Figure 2: Supply flows during the incident window showing rapid minting and divergence between price collapse and expanding supply.
This created a narrow but actionable decision window. Participants with real-time visibility into the breakdown were able to act before liquidity fragmented. Once the exploit became public and uncertainty spread across markets, exit conditions deteriorated rapidly and that window closed.
Because USR was widely used as collateral, this signal was not isolated. It propagated directly into vaults and lending markets, where the real impact materialized. Positions that treated USR as stable collateral were forced into rapid deleveraging, amplifying losses across dependent systems.
Figure 3: Real-time alerting across chains as USR entered a sustained critical state.
The dislocation was not uniform across chains. Liquidity conditions and pricing lag differed significantly, creating inconsistent signals depending on where participants were looking.
Figure 4: Cross-chain divergence in detection timing and price dislocation across Ethereum, Base, Arbitrum, and BSC.
What this event demonstrated is that stablecoin failures are not isolated price events. They are structural events that propagate through the systems built on top of them. Price deviation is the visible symptom, but supply changes, collateral assumptions, and system dependencies determine the severity of the outcome. This is the difference between observing a depeg and understanding its cause.
Expanding Vault Intelligence from USR Incident
What We Built: Expanding Vault Intelligence
The February vault rating system introduced five core risk clusters: smart contract integrity, protocol architecture, asset quality, operational health, and return performance. That foundation continues to evolve, with more rich historical incident/training data, faster detection, and more precise structural signals that USR exposed. Here are some of the signals we shipped as a result of this event, which factor into our risk rating.
Single-Block Mint Detection
USR highlighted the importance of detecting minting anomalies at the exact moment they occur. We now monitor single-block mint velocity. Large spikes in token creation within a single transaction are flagged immediately, allowing detection before price movement propagates through markets.
Single-Key Mint Authority Detection
The USR exploit was enabled by a single compromised key controlling minting authority. We now identify contracts where minting is controlled by a single externally owned account, without multisig or timelock protections. These configurations are flagged as structurally high risk before any incident occurs.
TVL and Supply Divergence Detection
During the USR event, supply increased faster than ecosystem data sources could reflect. We now track divergence between on-chain supply and reported collateral backing. When tokens are minted faster than they can be reconciled across data sources, this gap is surfaced as an early warning signal.
Supply Velocity (DEWS)
This is the longer-term complement to single-block mint detection. Instead of focusing on individual transactions, it tracks sustained issuance over time. Together, single-block velocity and sustained velocity capture both the initial exploit and the resulting expansion in supply.
A Safety Grade for Every Stablecoin
One of the most visible updates this month is simple by design. Every stablecoin on our depeg monitoring dashboard now receives a letter grade. The grade is powered by a composite score that ties together all the extracted features: on-chain supply behavior, peg stability history, collateral backing, protocol structure, and real-time stress signals. It condenses complex risk into something that can be understood and acted on immediately.
Figure 5: Stablecoin grading system combining structural, market, and real-time risk signals into a single composite score.
The goal is to make risk legible without requiring users to become analysts. A stablecoin rated A should not require a deep dive to build confidence. A stablecoin rated C-, D or F should prompt a closer look before allocation.
The grade is designed to reflect structural risk, not just recent price behavior. A stablecoin can appear stable under normal conditions. The grade surfaces what sits underneath, including concentration of minting authority, abnormal supply growth, and early signs of stress that may not yet be visible in price.
USR is a clear example of why this distinction matters. The structural vulnerabilities were present before the depeg. The grading system is designed to surface those risks earlier.
From Stablecoin Signals to Vault Exit Warnings
The stablecoin depeg monitor and the vault rating system now operate as a connected system in real time. Every vault holds collateral oftentimes a stablecoin or a stablecoin-backed asset. When the depeg monitor detects stress in one of those underlying assets, the signal is immediately propagated into the vault scoring system. The affected vault is re-evaluated in real time. The severity of the signal determines the response. Early stress, such as small price deviations or rising monitor scores, feeds into the vault’s depeg sub-score and begins to lower the overall risk profile. As conditions deteriorate, the system escalates. Vaults holding assets in the active depeg are flagged, surfaced in alerts, and assigned structured recommendations.
At critical thresholds, those recommendations become explicit exit signals visible within the dashboard. A vault holding a stablecoin under stress will display a WATCH or MONITOR flag. If the underlying asset is significantly off peg and classified as critical, the vault will surface an EXIT recommendation, including the affected asset and its deviation.
Figure 6: Vault-level risk escalation and exit recommendations triggered by underlying stablecoin stress signals.
These are dynamic signals. They update continuously as conditions change and clear automatically when stability returns.
Recursive Lending & Looping Detection
Recursive lending detection is one of the most meaningful signals we have added to the vault rating system. Vaults that practice looping, borrowing against deposited collateral to re-deploy into the same or correlated positions, carry hidden leverage that never shows up in a headline TVL figure. A vault with $50M in assets and a clean 8% APY can be running most of its exposure through recursive lending markets, where a sharp move in the underlying does not produce a gradual loss. It produces a cascade. We now compute the looping percentage for every vault we track, trace exactly which lending markets the leverage cycles through, and flag any vault where recursive exposure exceeds 80% as high_looping. For Morpho vaults we go a level deeper, resolving the full market chain with loan asset, collateral asset, and active supply in USD, so the leverage path is explicit rather than inferred. It takes work to get this right because it requires tracing capital flows across protocol layers rather than reading a top-level position. But for anyone doing serious due diligence on a yield strategy, knowing whether a vault is running high effective leverage on its own collateral is important information.
Figure 7: Recursive lending structure illustrating how looping amplifies exposure and creates cascading liquidation risk.
LST & LRT Collateral Exposure
Liquid staking tokens stETH, wstETH, rETH, cbETH and others are now deeply embedded in DeFi collateral stacks. They carry a structural property most yield-seekers overlook: redemption lag. When correlated sell pressure hits, the queue to exit can stretch from hours to days. A vault holding 60% of its collateral in wstETH is exposed to that lag in ways a standard price deviation check will never surface. We now track LST/LRT collateral percentage and USD value per vault, identify the specific symbols involved, and flag affected vaults accordingly.
Protocol Collateral Mapping
A vault marketed as a "USDC yield vault" may be routing through Spark markets backed by sDAI, which is backed by DAI, which has its own backing assumptions. The label tells you nothing. The collateral map tells you everything. We now resolve the full collateral stack for every vault that routes capital through a major lending protocol.
Figure 8: Full collateral stack resolution showing underlying asset dependencies beyond surface-level vault labels.
Real-Time APY Tracking
Yield data now refreshes more frequently. A vault offering 12% APY at market open may be offering 3% by afternoon as utilization shifts. Stale yield figures distort risk-adjusted comparisons, so keeping this data current ensures a more accurate view of risk and return without requiring a full re-rating cycle.
Yearn Vault Risk Scores & Emergency Shutdown Detection
Yearn vaults are now enriched with yDaemon risk scores directly from the Yearn infrastructure layer. More importantly: emergency shutdown status now surfaces explicitly. A vault in emergency shutdown is one where the Yearn team has halted operations due to a detected risk, this is a hard signal and now triggers immediate “attention_needed” flagging.
The API Layer: From Dashboard to Infrastructure
The dashboard is the visible layer of the system. The more significant change is underneath. We are actively building and expanding our API to make stablecoin and vault risk scoring programmatically accessible. Our goal is to move this data from a visual interface into a system that can be integrated directly into workflows, risk engines, and automated decisioning. We have aligned our vault data API to provide a consistent structure across all assets. Each record includes:
- TVL in USD
- APY
- Underlying asset details
- Composite risk score and tier
- Sub-scores and risk flags
- All enrichment signals introduced above
This enables a shift from manual analysis to programmatic decisioning. Risk becomes something systems can query, enforce, and act on automatically.Stay tuned for the upcoming announcement on the API scoring.
Conclusion: Monitoring as a Requirement, Not an Option
Resolv had audits, documentation, and an active user base. USR collapsed in under three hours and still remains depegged at the time of this writing. That is not an edge case, this is the reality of the threat landscape now. DeFi hacks do not announce themselves. By the time a price moves, the underlying failure has already occurred. The mint authority was already concentrated. The supply was already expanding without verification. The collateral assumptions were already fragile. None of it was visible in market data until it was too late.
The pattern holds across incidents. Structural conditions develop quietly. Price eventually reflects them. Most systems only see the price. The gap between those two moments, between when something breaks and when markets price it in, is where real exposure lives.
No monitoring system prevents failure. What matters is how much of that gap you can close. Price monitoring shows the surface moving, the structural signals explains why. Collateral monitoring shows where it spreads next. Each layer answers a different question. Together they compress the window between signal and response, the difference between exiting at par and being liquidated.
The USR incident is a clear demonstration of how quickly structural risk can surface, how far it can propagate, and how little time there is to act when those signals are not visible. It is important that we continue to learn from this and future events like it. Continuous signal intelligence is a prerequisite for operating at scale in these markets, and this is what we are building at Webacy.
