Usual Protocol pauses contract after USD0 exploit

Usual Protocol discovered a series of unvetted transactions. BlockSec reported the breach, which led to the pausing of all Usual smart contracts. 

BlockSec discovered a series of suspicious transactions originating from Usual Protocol. The issuer of the USD0 synthetic stablecoin paused the protocol until the threat is removed. 

Our @Phalcon_xyz system detected an hack to @usualmoney . Now the protocol has paused, we can share the link here:https://t.co/SYZnkOySRu

Book a demo to know how Phalcon can help protocol to monitor hacks and take automated actions. https://t.co/uYvbhlOwJh

— BlockSec (@BlockSecTeam) May 28, 2025

Within the first hour after the exploit, Usual Protocol clarified that no liquidity was drained and user funds were not affected. The hacker’s proceeds came from the arbitrage between USD0++ and USD0, and only amounted to $43K.

The exploit was linked to the main activity of Usual Protocol, the synthetic USD0, and the token’s form as a de facto bond. The exploiter managed to achieve a permissionless swap between the token’s bond form and tradable USD0. 

Later, some of the funds from the exploit were swapped through Uniswap V3 into Circle’s USDC. There is no data yet if the USDC has been frozen. 

Following the exploit, USUAL tokens traded around $0.12, as they remained unaffected by the hack. 

Usual Protocol exploited for the second time in days

The chief attack vector for Usual Protocol is its USD0++ token, which is the bond form of USD0. The switch between the two tokens is permissioned, but the attacker managed to swap the assets at a 1:1 ratio. 

On open exchanges, USD0++ and USD0 trade with some disparity, at $0.97 and $0.99 respectively. Previously, the project’s tokens have de-pegged as low as $0.85. 

The price difference between the bond form of the token, which is staked, and the freely trading USD0, has allowed the attacker to arbitrage the difference. 

On-chain researchers show a similar exploit happened in the past few days, but Usual Protocol remained mostly quiet about it. 

While the recent exploit only took $42,973 in the form of USDC, the possibility of repeated attacks led Usual Protocol to notice and freeze its smart contract. The Usual core protocol is still operational, with a pause only on the affected smart contract. 

Usual aims to recover value locked

Usual Protocol carries only around $380M in total value locked, falling from a peak of $1.7B in January. The platform suffered from its de-pegging event in early 2025, and has met only limited demand for its bond-based stablecoin. 

Staked USD0++ has a supply of around 569M tokens, while USD0 is at 635M tokens. The redemptions between the two assets may affect the valuations and stability of the project. 

The staked version of the token requires a four-year lockup and operates as a bond sold at a discount. The stablecoins are backed by tokenized assets issued by Ondo Finance, Hashnote, and BlackRock.

Usual Protocol is one of the DeFi experiments in offering passive income. However, the project also has other tools to abandon the staked asset. A small market on Curve Finance is available, where over 87% of all USD0++ is traded. 

Neither stablecoin is listed on major markets and relies on Uniswap or Curve Finance for its liquidity.