The USPD protocol just released an announcement confirming that it has suffered a meticulously planned attack.

The hacker employed a rather covert method—what's known as a "CPIMP attack" (Concealed Proxy in the Middle Proxy). Simply put, during the contract deployment phase, the attacker quietly managed to seize the admin privileges of the proxy contract in advance. To make matters worse, they disguised themselves as a legitimate, audited version and lay dormant for several months.

When the time was right, they launched the attack: minting approximately 98 million USPD tokens and then absconding with around 232 stETH.

The terrifying aspect of this attack method is that it can pass audit checks because everything appears normal on the surface. By the time it's discovered, the damage has already been done.