The post DeFi Protocol USPD Loses $1 Million in “CPIMP” Attack appeared first on Coinpedia Fintech News
A decentralized finance platform called USPD has fallen victim to a complex security breach that resulted in approximately $1 million being stolen from its protocol. What first looked like a normal system setup months ago was actually a hidden trap waiting to strike.
In the meantime, USPD is offering a 10% bounty if the attacker returns 90% of the stolen funds.
How the USPD Attack Happened?
According to blockchain security firm PeckShieldAlert, the attacker planted the trap all the way back on September 16, while the project was still being deployed. They used a clever technique during the proxy setup phase, gaining admin rights before USPD’s own deployment script could finish.
Meanwhile, this type of exploit is now being called a “CPIMP” attack, short for Clandestine Proxy In the Middle of Proxy.
What made this attack particularly sneaky was how well it was hidden. The hacker installed what security experts describe as a “shadow” implementation that cleverly forwarded everything to USPD’s properly audited contract.
By manipulating event data and storage information, they tricked blockchain explorer Etherscan into showing the legitimate, audited code, even though they had secretly planted their malicious version underneath.
.article-inside-link {
margin-left: 0 !important;
border: 1px solid #0052CC4D;
border-left: 0;
border-right: 0;
padding: 10px 0;
text-align: left;
}
.entry ul.article-inside-link li {
font-size: 14px;
line-height: 21px;
font-weight: 600;
list-style-type: none;
margin-bottom: 0;
display: inline-block;
}
.entry ul.article-inside-link li:last-child {
display: none;
}
- Also Read :
- Upbit Hit by $36M Solana Hack, Vows Full Reimbursement After Major Breach
- ,
Attack Finally Strikes, Losing $1 Million
After months of lying dormant and undetected, the attacker finally struck. They upgraded the proxy contract, minted around 98 million USPD tokens out of thin air, and withdrew approximately 232 stETH tokens before draining nearly $1 million in liquidity
The attacker operated through two addresses, now labeled “Infector” address (0x7C9…19d83 and the other was “Drainer” address (0x0883…3215A).
10% Bounty For The Attacker
The USPD team is working with law enforcement and white-hat researchers to track the stolen funds. They have asked all users to revoke approvals to stay safe.
They also said they are open to treating the hack as a “white-hat rescue” if the attacker comes forward.
To encourage this, USPD is offering a 10% bounty if the attacker returns 90% of the stolen assets.
Never Miss a Beat in the Crypto World!
Stay ahead with breaking news, expert analysis, and real-time updates on the latest trends in Bitcoin, altcoins, DeFi, NFTs, and more.
FAQs
The USPD protocol lost about $1M after an attacker exploited a hidden proxy setup planted months earlier.
The hacker used a “CPIMP” attack, secretly inserting a proxy that bypassed audits to mint tokens and drain liquidity.
USPD offers a 10% bounty if the attacker returns 90% of stolen assets, working with law enforcement and white-hat researchers.
Users should immediately revoke all approvals to prevent further unauthorized access to their funds.
A CPIMP (Clandestine Proxy In the Middle of Proxy) attack hides malicious code in a proxy, tricking audits and explorers like Etherscan.
