Usual Protocol Halts Contracts After Zero-Day Exploit Drains Funds

Another day, another DeFi hemorrhage—this time hitting Usual Protocol after an attacker bypassed safeguards to drain an undisclosed sum. The team hit the emergency pause button, but the damage echoes crypto’s recurring ’trust us, we’re decentralized’ paradox.

Zero-dollar exploits shouldn’t exist in 2025. Yet here we are, watching another protocol scramble post-breach while VCs cash out before the audit reports drop. Stay paranoid out there.

The exploit was linked to the main activity of Usual Protocol, the synthetic USD0, and the token’s FORM as a de facto bond. The exploiter managed to achieve a permissionless swap between the token’s bond form and tradable USD0. 

Later, some of the funds from the exploit were swapped through Uniswap V3 into Circle’s USDC. There is no data yet if the USDC has been frozen. 

Following the exploit, USUAL tokens traded around $0.12, as they remained unaffected by the hack. 

Usual Protocol exploited for the second time in days

The chief attack vector for Usual Protocol is its USD0++ token, which is the bond form of USD0. The switch between the two tokens is permissioned, but the attacker managed to swap the assets at a 1:1 ratio. 

On open exchanges, USD0++ and USD0 trade with some disparity, at $0.97 and $0.99 respectively. Previously, the project’s tokens have de-pegged as low as $0.85. 

The price difference between the bond form of the token, which is staked, and the freely trading USD0, has allowed the attacker to arbitrage the difference. 

On-chain researchers show a similar exploit happened in the past few days, but Usual Protocol remained mostly quiet about it. 

While the recent exploit only took $42,973 in the form of USDC, the possibility of repeated attacks led Usual Protocol to notice and freeze its smart contract. The Usual Core protocol is still operational, with a pause only on the affected smart contract. 

Usual aims to recover value locked

Usual Protocol carries only around $380M in total value locked, falling from a peak of $1.7B in January. The platform suffered from its de-pegging event in early 2025, and has met only limited demand for its bond-based stablecoin. 

Staked USD0++ has a supply of around 569M tokens, while USD0 is at 635M tokens. The redemptions between the two assets may affect the valuations and stability of the project. 

The staked version of the token requires a four-year lockup and operates as a bond sold at a discount. The stablecoins are backed by tokenized assets issued by ONDO Finance, Hashnote, and BlackRock.

Usual Protocol is one of the DeFi experiments in offering passive income. However, the project also has other tools to abandon the staked asset. A small market on Curve Finance is available, where over 87% of all USD0++ is traded. 

Neither stablecoin is listed on major markets and relies on Uniswap or Curve Finance for its liquidity.

Cryptopolitan Academy: Coming Soon - A New Way to Earn Passive Income with DeFi in 2025. Learn More