Stablecoin USPD looted by hackers for millions of dollars, "CPIMP" attack hidden for months finally exposed

2025-12-05 06:28:23

[Bitpush] Stablecoin project USPD recently took a major hit—a hack resulted in losses exceeding one million USD.

The official team has confirmed that the protocol was breached. The attacker played dirty, minting tokens without authorization and then draining the liquidity pool. The project team is now urgently calling on all users to revoke token approvals for the USPD contract immediately to avoid secondary losses.

The attack method was quite insidious and is known as a “CPIMP” attack. The hacker acted during the contract deployment phase—front-running the initialization of the proxy via Multicall3, directly seizing admin rights, and then disguising the contract as a normal, audit-passed one. This operation went undetected for several months until it was exposed during a recent proxy upgrade.

The data is pretty grim: the attacker minted about 98 million USPD and transferred approximately 232 stETH. The project team has made the attacker’s addresses public—mainly 0x7C97…9d83 (Infector) and 0x0833…215A (Drainer).

Currently, the team is working with law enforcement and white hat hackers to track the stolen funds. They’ve offered the attacker a deal: return the funds voluntarily and keep 10% as a bounty. But judging by the situation, this is probably just a routine gesture.

STETH-3.6%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

7 Likes

Reward
7
7
Repost
Share

Comment

0/400

BitcoinDaddy

· 15h ago

It's the same old trick again—got exploited right at the deployment stage. The audit was basically useless. This industry is just too shady.

View OriginalReply0

DefiPlaybook

· 15h ago

Same old trick again, planting traps during the deployment phase—how did the auditors miss this? This CPIMP attack method is really nasty, hiding for months before being exposed... Honestly, vulnerabilities like this should have been standardized and prevented by the industry long ago. --- 98 million tokens minted out of thin air—this is the price of centralized governance. Privileged access lets you transfer anything, just like that wave back in 2020. --- Better revoke authorizations ASAP, but the problem is the portion that's already been drained... What are the chances of recovering it? --- Can this round still be recovered, or is it just going to end up as another blacklist of new addresses? Feels like the crypto world's contingency plans have never evolved. --- Swapping between 232 stETH, the attacker is demonstrating what "leaving no trace" really means—not even using a mixer. --- At the core, it's still that smart contract auditing is just too shallow. The quality of code that passes audits is all over the place.

View OriginalReply0

MEVictim

· 15h ago

Damn, this routine again? It got exploited during the deployment phase and still managed to stay hidden for so long. Was the audit team asleep?

View OriginalReply0

MemeTokenGenius

· 15h ago

Another one of those traps set during the deployment phase. How come nobody noticed this two months ago... The name CPIMP already sounds sketchy. Hold on, let me check if I still have this crappy token in my wallet.

View OriginalReply0

WalletDivorcer

· 15h ago

Another stablecoin has collapsed again. Audits are pointless; the contract got fatally exploited during the deployment stage.

View OriginalReply0

LightningSentry