Research
Mar 30, 2026·5 min
Research：Anatomy of a Morpho vault NAV flash loan manipulation attack after the USR depeg
On March 22, 2026, the Resolv protocol suffered a private key compromise. The attacker minted 80 million unbacked USR tokens out of thin air, crashing USR from $1 to as low as $0.025. But the blast radius extended far beyond USR holders — a separate group of sophisticated actors exploited Morpho's vault mechanics to extract real value through a precision NAV manipulation attack. This article breaks down the underlying logic, step by step. 1. Understanding Morpho's two-layer architecture Befo
