Resolv Protocol Incident Analysis

How Sui's Address Balance layer enables gasless stablecoin transfers, and why the May 2026 mainnet halts exposed risky boundaries between gas charging, settlement, and validator restarts.

On 6 September 2026, attackers primed the Elements rangeproof cache and reused a cached validation result to mint unauthorized L-BTC, then pegged out roughly 3,998.5 L-BTC worth about $318.7 million.

On 23 July 2026, an attacker embedded duplicate state roots in Verus notarizations and relayed them to Ethereum, overwriting the trusted root to authorize inflated withdrawals and drain $7.44M.

On 16 July 2026, DeFiTuna on Solana lost $569,601 USDC: attackers routed borrowed USDC through an illiquid TUNA/USDC pool, rounding the position's assets to zero and bypassing the solvency check.

The JaredFromSubway MEV bot lost 4,424 ETH (~$7.5M) to an approval hijacking: bait tokens and fake arbitrage pools tricked the bot into granting approvals the attacker later used to drain reserves.

CertiK's Grey Box Chain Audit injects faults into live multi-node deployments to test consensus, bridges, and recovery paths. A Concordium engagement found 13 issues, including 2 critical DoS bugs.