
Unchained Uneasy Money: How the Resolv Hack Shows an Audit Doesn't Mean 'Secure'
Mar 27, 2026
Omer Goldberg, founder and CEO of Chaos Labs and DeFi risk analyst, breaks down the Resolv hack timeline and why a single key and audit gaps mattered. He covers how keys were compromised, supply-chain and operational failures, contagion through lending pools, and practical mitigations like rate limits and multi-party controls.
AI Snips
Chapters
Transcript
Episode notes
Cloud Key Management Isn’t Foolproof
- AWS key storage is not a panacea; compromise of an AWS account can grant an attacker live control to mint tokens without exporting any private key.
- Taylor Monahan explained the attacker likely used AWS access to command the mint function directly instead of exfiltrating the key, turning cloud convenience into a single-point failure.
Add On-Chain Reserve Checks And Mint Velocity Caps
- Use on-chain reserve oracles and mint velocity controls to detect and throttle abnormal supply increases.
- Omer Goldberg recommended proof-of-reserve checks and mint rate caps (e.g., max per hour) so an 80M instantaneous mint would be impossible.
Put Hard Limits And Multi-Party Controls On Minting
- Limit on-chain mint power and require multi-party approval for critical functions to prevent unilateral infinite mints.
- Omer Goldberg recommended rate limits (e.g., hourly caps), multi-sig/2FA layers, and on-chain reserve checks to make massive instantaneous mints infeasible.

