On March 22, Eastern Eight Zone time, Resolv/ResolvLabs released USR and soon encountered suspected exploitation of vulnerabilities. An initial fund of only 100,000 USDC was abnormally minted into 50 million USR, which was then rapidly disassembled, swapped, and transferred. On-chain public information shows that most of the funds ultimately pointed to a long position in ETH worth approximately 4.55 million dollars, subtly resonating with large purchases of ETH by various parties on the same day. The biggest mystery left by this incident is why the security mechanism failed at a critical juncture, and why “smart money” resolutely bet on ETH amidst the chaos.

100,000 to 50 million: The beginning of the USR minting ratio out of control

According to currently visible on-chain data, the starting point of this incident was an extraordinarily abnormal minting ratio: the attacker only invested 100,000 USDC and minted 50 million USR, which severely deviates from any normal risk control and collateral rules. Whether it was a distortion in oracle price feeds or a circumvention of the minting logic, this result indicates that the core safety valve in the minting phase of the protocol was breached. Price anchoring should have been the underlying logic of such products, and the loss of control at this step directly opened the floodgates for subsequent fund migrations.

After minting a large amount of USR, the attacker began to dismantle the chips step by step. According to the brief, approximately 35 million USR was exchanged for wstUSR, and further exchanged for mainstream dollar assets such as USDC and USDT. This process manifests on-chain as a one-way withdrawal from the protocol asset pool to the stable asset pool, compounded by the rapid decoupling of USR's own price, creating a typical “run” type of sell-off scenario. However, due to the current public information lacking on-chain details of the wstUSR exchange path, we can only roughly confirm that funds flowed from the internal protocol asset pool to a broader external stable asset market, but we cannot reconstruct each contract call and path selection.

Also in an information vacuum are the specific technical vectors and identities of the participants behind this operation. Whether how the vulnerability was triggered at the contract level, how the calling sequence was designed, or whether the attacker previously conducted targeted tests and rehearsals, there are currently no disclosed verifiable white-box details. On-chain addresses themselves are just cold, hard strings, lacking any reliable information linking to real individuals or organizations. Under such constraints, the only vague outline that can currently be sketched of the event is “100,000 USDC → 50 million USR → 35 million USR escaping → stable assets,” not a complete “technical detective novel.”

Price plummeting 74%: The trust backlash after USR's decoupling

When the minting ratio went out of control and a massive amount of USR was slammed into the market, the price trajectory provided the most intuitive feedback. The brief shows that USR experienced a maximum drop of up to 74.2%, plummeting from a price range close to 1 dollar to less than a quarter of that, before slightly recovering from extreme panic, bouncing back to around 0.7847 dollars. For an asset originally centered on the narrative of “stability,” such a cliff-like market performance signifies that anchoring expectations have been thoroughly breached in a short time.

For holders, the paper losses were just the first layer of impact; deeper was the doubt about the mechanism and the risk control capability of the issuer. Positions that were once regarded as “cash equivalents” exposed their liquidity fragility and price elasticity under extreme market conditions overnight, forcing users to reassess the risk premium of holding. For market makers and LPs providing liquidity for USR, such a one-sided waterfall decline typically means a severe imbalance in the asset structure of the fund pool, leaving behind “problem assets” that are difficult to clear in time, making natural arbitrage recovery hard in the short term.

Once the trust in the protocol is damaged, its effects often extend beyond the price itself. First, there is the continued contraction of subsequent liquidity: existing LPs may choose to withdraw, and potential LPs will be more cautious, making it difficult for the protocol to restore its previous depth and trading efficiency. Secondly, there is a long-term discount on pegging expectations: even if the price technically rebounds close to 1 dollar, the market may treat similar assets as high-risk varieties for a considerable time, rather than purely as accounting units. Finally, the decline in secondary market trading activity: after the panic, the speculative capital willing to bet on such assets will significantly decrease, with trading volumes and interest dropping, further weakening their voice in larger markets. This series of chain reactions makes this event much more than just a “price spike,” but rather a pressure test of the trust system.

4.55 million dollars sweep for ETH: The endpoint for aggressors

When USR and the protocol itself were plunged into chaos, the successfully cashed-out funds showed a highly consistent direction on-chain: ETH. According to reports from several Chinese media and briefs, after the attacker completed the exchange from USR to wstUSR to USDC/USDT, they chose to convert most of the profits into approximately 4.55 million dollars worth of ETH, transforming an attack into a concentrated bet on a mainstream asset. This series of operations also happened around March 22, overlapping significantly with the timing of the incident, displaying a strong grasp of timing and execution rhythm.

From the perspective of risk and return, such a choice is not entirely unexpected. On one hand, compared to staying on-chain in relatively “new” and “small” assets, shifting to ETH, a large-scale, deeply liquid mainstream asset can actually reduce future slippage and price impact risks to some extent. For already conspicuous large “black funds,” choosing an object that can circulate across multiple chains and exchanges helps retain more options in subsequent asset fragmentation, cross-chain transactions, and exits.

On the other hand, in terms of traceability, the “transparency” of ETH is both a risk and a refuge. All actions are exposed on-chain, but because of its massive scale and multitude of participants, precisely tracking a single address back to a real identity is not an easy task. In contrast, if they remained in low-market-cap tokens or pools with weak liquidity, every transfer would leave an anomalous “highlight” in the data, making them more likely to become targets of scrutiny. From this logic, rapidly “rolling” the spoils into ETH can also be seen as a risk rebalancing under high-pressure circumstances.

More dramatically, also on March 22, well-known investor “Maji Brother” Huang Licheng was reported to have rebuilt a long position in ETH worth about 4.62 million dollars with 25 times leverage in the derivatives market (data sourced from BlockBeats). On one side is the suspected exploiters pressuring ETH spot with 4.55 million dollars, while on the other is a well-known KOL betting in the same direction in the derivatives market with high leverage; the amounts are similar, and the timing is closely aligned, adding a strong dramatic tension to the bullish narrative of ETH that day.

Off-exchange whale withdrawals and bullish resonance

Zooming out from the protocol attack and celebrity positions to the exchange level, one can still see a similar rhythm on March 22. On-chain monitoring data shows that a whale address withdrew 1,979 ETH from Kraken during this period, equivalent to about 4.16 million dollars at that time's price. Looking at a longer period, that address has cumulatively withdrawn 8,662 ETH from Kraken over the past month, far exceeding a single operation. Compared to the attacker’s 4.55 million dollars ETH spot purchase and Huang Licheng's 4.62 million dollars leveraged long, this exchange whale's withdrawal further stoked the bullish atmosphere for ETH on that day.

Placing these roles on a timeline: on one end is an initial 100,000 USDC that ultimately converted to 4.55 million dollars of ETH by the attacker; on the other end is the celebrity investor returning to the ETH battlefield with 25 times leverage; and another end is the off-exchange large holder quietly continuing to “move chips” out of centralized exchanges. Three originally unrelated lines of funding provided a highly consistent directional choice around the same asset on the same date—increasing holdings in ETH. Narratively, this resembles a puzzle of a “bullish intensive layout day” rather than isolated buying behaviors.

It is important to note that under the premise of the absence of on-chain evidence, any speculation about the actual connection between these three addresses lacks basis. There has been no publicly verified on-chain jumping paths or identity overlaps between the attacker’s address, the celebrity's contract account, and the Kraken withdrawal wallet; they can only be regarded as independent participants. All we can do is observe the market sentiment reflected by this “coincidental resonance” from a macro chip direction and funding preference: despite localized security incidents and extreme fluctuations, on a larger scale, mainstream funds are still accumulating ETH during volatility, rather than choosing to fully retreat.

The shadow of war and long-term chips: Tom Lee’s macro footnote

Zooming out to a macro perspective, everything that happened on March 22 is embedded within a larger emotional context—ongoing geopolitical tensions, the shadow of war, and the continued fermentation of risk aversion demands. BitMine Chairman Tom Lee previously proposed a widely discussed view in public: “Wars are often buying opportunities for long-term investments”. Its core logic is that short-term uncertainty amplifies volatility and drives emotional capital away, while true long-term capital often builds positions in risk assets with a fundamental basis during panic.

If this logic is projected onto the crypto market, one can see a narrative taking shape: outside traditional safe-haven assets (such as gold and US Treasuries), mainstream crypto assets like ETH are viewed by some funds as “high beta safe-haven tools”—capable of absorbing liquidity overflow during risk events and enjoying greater upside elasticity after risk eases. For funds chasing relative returns, holding ETH, which is more volatile yet has a stronger long-term narrative, might be a more aligned allocation option with the “buy in a time of war” logic compared to stable but low-yielding traditional assets.

Within this larger framework, the attacker rolling spoils into ETH, the celebrity choosing to return to the ETH battlefield with 25 times leverage, and whales continuously withdrawing thousands of ETH from exchanges are not just isolated speculative cases, but a part of structural repositioning in the market. On one hand, this USR incident exposed the shortcomings of emerging issuers and complex protocols in terms of security, risk control, and trust building, leading some funds to significantly cool their risk preference for “new stories” and “small assets.” On the other hand, the status of ETH as a foundational asset, against the backdrop of increasing L2 extensions, application ecology, and institutional participation, seems more like “an anchor in a storm.” When external geopolitical risks rise and the market’s demands for safety and liquidity simultaneously increase, reallocating chips from complex protocols and marginal assets to large-scale assets like ETH itself represents a natural structural adjustment.

From a minting failure, view the next round of security and chips

Returning to the event itself, the gap that tore open the minting logic of USR on March 22 revealed risks on two levels: first, the weakness of the protocol security architecture, including inadequate protection for key links such as price oracles, minting permissions, and upper limit controls; second, the market’s excessive trust in small issuers, being willing to view them as tools comparable to mature products despite lacking adequate auditing and stress testing. This poses a clear warning for the entire sector— in an increasingly complex on-chain financial world, “security” and “trustworthiness” cannot simply be outsourced to branding or marketing; they must be implemented into verifiable code and clear risk boundaries.

Looking forward, there are several important observation points regarding the evolution of this incident. The first is the subsequent recovery path for USR's price: after experiencing a maximum drop of 74.2%, even if it technically rebounds to about 0.7847 dollars, whether the market is willing to re-establish its anchoring trust close to 1 dollar over a longer horizon remains in doubt. The second is whether the overall trust in the protocol can be restored: it includes whether new funds are willing to re-enter its ecosystem, whether existing participants choose to continue providing liquidity, and whether the secondary market can become active again. The third is whether regulations and public opinion will strengthen focus on similar incidents: when it involves uncontrolled minting and large-scale asset transfers, external regulators and mainstream media’s attention is often attracted afterwards, thereby reshaping the entire sector’s rules and expectations.

Looking at a longer time frame, another side presented on March 22 may be worth noting for this cycle: against the backdrop of protocol vulnerabilities, price crashes, and panic emotions intersecting, funds across different dimensions coincidentally increased their holdings in ETH—from the attacker’s 4.55 million dollars worth in spot, to the celebrity’s 4.62 million dollars leveraged long, to whales withdrawing thousands of ETH out. Whether this “good chips in bad news” represents a clever layout before the next cycle or merely an emotional resonance is something no one can confirm today. However, it is certain that when the story concludes, and the price curve is extended to years, those mainstream chips that were quietly siphoned away in the chaos will, at some future point, write a footnote for that day.

Join our community to discuss and become stronger together!
Official Telegram community: https://t.me/aicoincn
AiCoin Chinese Twitter: https://x.com/AiCoinzh

OKX welfare group: https://aicoin.com/link/chat?cid=l61eM4owQ
Binance welfare group: https://aicoin.com/link/chat?cid=ynr7d1P6Z

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。