USPD suffered a $1M exploit after an attacker seized its proxy admin rights during deployment, enabling the minting of 98M USPD and draining 232 stETH. The team warns users to avoid the token and revoke approvals.

"According to USPD, the attacker front-ran the initialization process on Sept. 16 using a Multicall3 transaction. The attacker jumped in before the deployment script finished, grabbed admin access, and slipped in a hidden proxy implementation. In order to keep the malicious setup hidden from users, auditors, and even Etherscan, that shadow version forwarded calls to the audited contract. The camouflage worked because the attacker manipulated event data and spoofed storage slots so that block explorers displayed the legitimate implementation. This left the attacker in full control for months until they upgraded the proxy and executed the minting event that drained the protocol."

Top comment by @Spencer420

More coverage

• USPD stablecoin hack reveals clandestine proxy attack (en.cryptonomist.ch)
• Explained: The USPD Hack (December 2025) - Halborn (halborn.com)
• Shocking USPD Exploit: Decentralized Stablecoin Loses $1 Million ... (cryptorank.io)
• USPD Hack: $1M Gone in Stablecoin Breach - Binance (binance.com)
• USPD stablecoin protocol hacked for $1 million so far - Cryptopolitan (cryptopolitan.com)

Explore the topic

• USDC
• stETH
• Exploit