CI/CD compromise cost: $300K

CI/CD compromise cost: $300K A single stolen developer credential can do more damage than a loud break-in at the front door. In the Resolv incident disclosed on April 4, 2026, attackers used a contractor-linked GitHub credential as their first foothold, reached signing systems tied to the protocol’s minting flow, and turned that access into roughly $25 million in extracted Ether after minting 80 million unauthorized USR tokens. (resolv.xyz) The headline number in the card summary is $300,000, but the Resolv postmortem describes a much bigger chain of loss. Resolv says the March 22, 2026 attack led to two illicit transactions, 80 million USR minted, and about $25 million in value extracted as Ether, with about 46 million USR later neutralized through burns and blacklist controls. (resolv.xyz) The lesson is not really about one crypto protocol. It is about where modern companies keep their real power: not only in production servers, but in the build and deployment machinery that can change code, sign releases, inject secrets, and push trusted updates into live systems. (resolv.xyz) Continuous integration and continuous delivery, usually shortened to CI/CD, is the assembly line for software. When a developer pushes code to a repository, that pipeline can run tests, build artifacts, fetch secrets, sign packages, and deploy changes automatically, which means the pipeline often has broader access than any one engineer sitting at a laptop. (aembit.io) That access makes CI/CD credentials unusually valuable to attackers. A stolen GitHub token or bot account is not just a password to a code host; it can be a master key to workflow files, release tags, cloud credentials, package registries, and the logs where sensitive data sometimes leaks by accident. (aembit.io) Resolv’s own account of the breach shows how that escalation can happen in practice. The company says the attack began outside its infrastructure, through a credential associated with a contractor’s GitHub account that had been retained from a prior engagement with a third-party project, and that foothold eventually gave attackers unauthorized access to signing infrastructure used by the protocol’s on-chain services. (resolv.xyz) That detail matters because signing infrastructure is where trust gets turned into action. In many systems, a signer is the component that says, in effect, “this request is legitimate, go ahead,” whether the next step is publishing a software release, approving a cloud action, or finalizing a token mint. Once an attacker controls that checkpoint, they do not need to smash the smart contract or break the application logic directly. (resolv.xyz) Resolv’s postmortem is a clean example of this split between code security and operational security. The protocol describes a two-step minting flow in which a user submits an on-chain request and an authorized off-chain service later confirms the parameters and finalizes how much USR is issued, so the attacker’s path ran through the off-chain authority layer rather than a classic bug in the on-chain contract itself. (resolv.xyz) This is why CI/CD attacks feel disproportionate. A perimeter breach might expose one machine, but a pipeline breach can expose every environment the pipeline touches, because the pipeline was designed to move freely across those boundaries in order to ship software quickly. (aembit.io) Recent supply-chain cases outside Resolv show the same pattern. In the 2025 compromise of the widely used `tj-actions/changed-files` GitHub Action, researchers said attackers altered a maintainer bot account and used the malicious component to scrape secrets from Continuous Integration and Continuous Delivery server memory, exposing items such as Amazon Web Services keys, GitHub tokens, npm credentials, and private RSA keys across more than 23,000 organizations. (aembit.io) The March 2026 Trivy GitHub Actions compromise pushed that pattern further. Socket reported that an attacker force-updated 75 of 76 version tags in the official `aquasecurity/trivy-action` repository, turning trusted version references into a delivery channel for malware that targeted runner memory, Secure Shell keys, cloud credentials across Amazon Web Services, Google Cloud Platform, and Microsoft Azure, and Kubernetes service account tokens. (socket.dev) Those cases help explain why attackers like developer tooling. Developers trust it, automation runs it without hesitation, and organizations often grant it broad permissions because friction in the build system slows releases and annoys engineering teams. The same convenience that makes automation useful also makes it dangerous when identity controls are weak. (aembit.io) Resolv says it has revoked identified compromised credentials, paused most protocol operations, notified authorities, and brought in outside firms including Hypernative, Hexens, MixBytes, SEAL 911, Mandiant, and ZeroShadow for forensic and recovery work. It also says pre-hack USR holders are being compensated one-for-one, with most redemptions already processed. (resolv.xyz) The harder part is not incident response but redesign. If a contractor credential from an earlier third-party engagement can still open doors, then the problem is not just one stolen secret; it is a chain of standing trust relationships that lasted longer than the work itself. (resolv.xyz) The practical fix is boring and strict. Pipelines need short-lived credentials instead of long-lived secrets, repository actions pinned to immutable versions instead of moving tags, tighter separation between source control and signing systems, and aggressive pruning of contractor, bot, and service access after each project ends; Resolv’s postmortem and the recent GitHub Action compromises all point in that same direction. (resolv.xyz) The old model of security treated developer tooling as back-office plumbing. The newer reality is that a build runner, a bot account, or a forgotten GitHub credential can sit closer to money and production authority than the public-facing application ever does. (resolv.xyz) If you want, I can turn this into a longer reported piece, an executive brief, or a 10-12 tweet thread in the same style.