Leaderboard
631All-time rank
UP
US Permissionless Dollar
Dec 4, 2025
$1.0M
Lost
$1.0M
Recovered
$0
Net loss
$1.0M
Unrecovered0% recovered
In December 2025, USPD stablecoin protocol was exploited through its smart contract deployment process. Attacker used Multicall3 to claim admin role before the official deployment script, then deployed a malicious proxy that forwarded to the audited code while using event manipulation and storage slot spoofing.
After months, attacker minted 98M USPD and drained ~$1M in stETH.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Proxy Upgrade Hijack
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Dec 4, 2025Exploit executed — $1.0M drained via proxy upgrade hijack
- Attributed to Unknown
- Recovery status Unrecovered 0%