Hack history / 2025 / Hack or exploit
USPD
Hack or exploit on Dec 4, 2025 · Proxy Upgrade Hijack
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$1M
dollars at the time
Returned
none listed
as the sources state it
Rank
#921
among thefts by dollars lost
What happened
In December 2025, USPD stablecoin protocol was exploited through its smart contract deployment process. Attacker used Multicall3 to claim admin role before the official deployment script, then deployed a malicious proxy that forwarded to the audited code while using event manipulation and storage slot spoofing. After months, attacker minted 98M USPD and drained ~$1M in stETH.
Details
- Date
- Dec 4, 2025
- Kind
- Hack or exploit
- Method
- Proxy Upgrade Hijack
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
Cite this page
SwanBluechip, "USPD hack, Dec 4, 2025: $1M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht324a13dfb7/ (data as of 2026-10-31).