Hidden Proxy Sat Undetected for 78 Days Before Draining $1M From USPD

USPD's smart contracts passed audit review and its unit tests held up fine. What the protocol failed to notice was that an outside party had been sitting in its admin role for nearly three months.

On December 4th, an attacker drained roughly $1 million from USPD: 98 million USPD tokens were minted without legitimate backing and 232 stETH was pulled from reserves. The protocol subsequently offered the attacker a 10% bounty in exchange for returning the rest.

The intrusion didn't rely on breaking any code. Instead, the attacker exploited the gap between deploying a contract and initializing it.

The attacker front-ran USPD's proxy initialization on September 16th, installing an intermediary "shadow" proxy that quietly forwarded every legitimate call to the real, audited implementation for 78 days — all while Etherscan continued to display the legitimate contract as if nothing were wrong.

Functionally, everything worked. The audits themselves were accurate — but the admin permissions had belonged to an outside actor since day one.

Credit: Peckshield, USPD, CertiK, Phantom Security, Dedaub, Blockscope, AstraSec, Emmet Gallic, Cryptonomist, ilemi, HokaNews, Blockthreat, Mladenov

01A known attack vector, missed anyway

Measured against Rekt's leaderboard of historical incidents, a $1 million loss is modest. What makes the USPD case notable is not the size of the loss but its avoidability.

The exploit has been named CPIMP — Clandestine Proxy In the Middle of Proxy — a vulnerability class that security researchers had already identified, documented and largely contained back in July 2025.

That summer, Dedaub, Venn Security and SEAL 911 ran a 36-hour coordinated response to patch infected proxy contracts across multiple chains, ultimately protecting more than $10 million and alerting a range of affected protocols — including Kinto, Pendle, GMX, Texture, and Peapods.

USPD launched two months after that response, apparently without adopting the fix.

02How the takeover happened

USPD deployed its proxy on September 16th, 2025, using a two-transaction process: deploy first, initialize second. Data compiled by researcher ilemi from Herd lays out the exact timing:

• 9:01:59 AM: proxy contract deployed.
• 9:02:11 AM: the attacker's initialization transaction executed instead.
• 9:02:35 AM: USPD's own initialization transaction landed — 24 seconds behind the attacker's.

A 24-second gap between deployment and legitimate initialization was enough. The attacker, monitoring the mempool for USPD's pending initialization call, used a single Multicall3 transaction to seize admin control before the protocol's own script could complete.

What followed diverged from typical exploit behavior. Rather than draining funds immediately — a move that tends to draw rapid attention — the attacker deployed an intermediary "shadow" proxy that relayed every call through to USPD's genuine, audited implementation. Users and auditors alike interacted with, and verified, the legitimate logic; nothing appeared abnormal on the surface.

Behind that facade, the attacker manipulated event logs and spoofed the storage values Etherscan reads to identify a proxy's implementation address, so the block explorer continued to display the audited contract even though calls were actually being routed through the attacker's intermediary first.

Under normal proxy operation, a transaction trace shows a single delegatecall from proxy to implementation. A CPIMP-infected proxy shows two: proxy to malicious middle layer, then middle layer to the legitimate implementation — a detectable but easily overlooked signature.

The mechanism also included a self-restoring feature: after each delegated call completed, the malicious contract would rewrite its own address back into the implementation storage slot, undoing any attempt to upgrade it away. Block explorers verify implementation addresses by reading the EIP-1967 storage slot rather than trusting emitted events alone, and it was precisely that storage slot the attacker was spoofing.

The setup then went dormant for 78 days. On September 17th — the day after the initial takeover — the attacker made one further move, granting privileged roles to a second contract under their control. After that, there was no further on-chain activity until December 4th.

03The extraction

On December 4th, the attacker upgraded the proxy to a version permitting unrestricted minting, then deposited 3,122 ETH as collateral and minted 98 million USPD against it — roughly ten times what that collateral should have supported. 232 stETH was drained from the protocol, and a portion of the newly minted USPD — about $300,000 worth — was swapped for USDC through Curve. Roughly $1.05 million ended up sitting in the attacker's wallet once the operation concluded.

The mechanics of the mint: the attacker called upgradeAndCall, swapping in the malicious implementation and executing the exploit within a single atomic transaction. The new logic let them mint against the same 3,121.95 ETH collateral ten separate times, producing about 9.8 million USPD per cycle — 98 million tokens total, against collateral that should have supported under 10 million. Separately, 237 stETH was withdrawn from protocol reserves across multiple addresses, with the resulting USPD dumped into Curve pools for $300,000 in USDC.

As of this writing, about $1.01 million remains in the attacker's wallet — not routed through Tornado Cash, not split across wallets. Whether that reflects consideration of USPD's 10% bounty offer or simple patience is unclear.

04Wallets and transactions

The September infiltration and December extraction were carried out from separate addresses, dubbed by the community "The Infector" and "The Drainer."

Infector address: 0x7C97313f349608f59A07C23b18Ce523A33219d83

Front-running transaction that captured admin rights (September 16): 0xc0b7e490caac2b8cfa5e62d1b28a5e7dba7600e623c71352acbc9b23c2b65b7c

Privilege-grant transaction (September 17): 0xf9a493f061fbf17fe2cf7c26d6b03d85c6b43026500e61728933c2e218581079

Drainer address: 0x083379BDAC3E138cb0C7210e0282fbC466A3215A

Attack transaction (December 4): 0xa7cab072bf0453301a0ab1b06c49a9405d115824fc617fb42cba9b70f3b893c2

05USPD's response

USPD posted its official statement on X at 10:40pm UTC on December 4th, opening with an "URGENT SECURITY ALERT."

The team stated the incident "was not a flaw in our smart contract logic" — a claim that is technically accurate. The audits performed by Nethermind and Resonance reviewed the code as written, and the code as written functioned correctly. What those audits could not have caught was a malicious proxy injected during deployment itself — a component that never existed in the reviewed codebase and therefore was never in scope for review. The vulnerability lay in the deployment process, not the contract logic.

AstraSec's post-incident guidance was direct: proxy deployment and initialization should always occur within the same transaction to eliminate front-running risk of this kind — precisely the pattern USPD did not follow.

USPD's messaging characterized CPIMP as a novel and highly sophisticated threat. In fact, Dedaub had published a detailed technical breakdown and Venn Security and SEAL 911 had already run a 36-hour mitigation effort covering multiple protocols four months prior to USPD's launch.

USPD's proposed resolution with the attacker followed the standard white-hat template: the attacker keeps 10%, returns the remaining 90%, and USPD agrees not to pursue law enforcement action.

The offer went unanswered over the following weekend, with the funds remaining untouched. By Monday, December 8th, 330 ETH had been moved through Tornado Cash from the attacker's address, suggesting a decision may have been made.

Four days after the incident, USPD published a recovery roadmap outlining a V2 launch targeted for Q2 2026, a claims process for affected token holders, a recovery pool to be funded from future protocol revenue, and a wallet-gated Telegram channel for the roughly 230 affected users. The stated priority is to make holders whole before any other fund allocation, though that outcome depends on V2 shipping on schedule and generating sufficient revenue.

Despite the incident, USPD's stablecoin retained its peg even with 98 million unbacked tokens in circulation. Trading volume fell about 20%, to roughly $2.56 million.

06Not an isolated pattern

USPD is not the first protocol to fall to this exact sequence. Kinto Protocol suffered an identical structure of attack earlier in 2025: deployment at 20:24:40 on March 19th, attacker initialization two seconds later at 20:24:42, and a $1.55 million loss realized on July 10th once the attacker chose to act. The gap in Kinto's case was two seconds rather than USPD's 24 — but the underlying pattern, the dormancy period, and the eventual trigger were the same.

Notably, the July mitigation effort that protected dozens of protocols from CPIMP did not catch either the Kinto or USPD infections in advance, even though the compromised state was visible on-chain to anyone querying for it.

As researcher ilemi noted: "24 seconds between attacker and team transactions. This alone should have been a huge red flag... but this data is not easy to find or see unless you know how to write Dune queries."

Security researcher 0xmladenov offered a broader explanation for why this keeps happening: "Deployment steps are often marked out of scope in audits with the assumption they'll be handled later, and too often they're not." In practice, this means audit firms verify code thoroughly while the live deployment moment — the point at which that code actually goes on-chain — frequently falls outside any formal review. Nethermind and Resonance audited what they were engaged to audit; the deployment sequence itself was nobody's assigned responsibility.

07Summary

USPD lost roughly $1 million after an attacker front-ran its proxy initialization on September 16, 2025, installed a self-concealing shadow proxy that spoofed Etherscan's verification display, waited 78 days without detection, and then exploited unrestricted minting rights on December 4th to create 98 million unbacked USPD tokens and drain 232 stETH from reserves. The technique, CPIMP, had been publicly documented and mitigated across other protocols months earlier following a Kinto Protocol incident with the same structure. As of publication, roughly $1.01 million remains in the attacker's wallet, part of it already moved through Tornado Cash, while USPD pursues a recovery plan tied to a V2 launch planned for Q2 2026.