The open-source payment platform UPCX suspended transactions following an unauthorized withdrawal of approximately $70 million in digital assets.
Blockchain security firm Cyvers identified the breach on April 1, flagging suspicious activity involving 18.4 million UPC tokens.
Cyvers reported that an attacker gained control of a UPCX administrative wallet and modified its ProxyAdmin contract.
This enabled the execution of a withdrawal function, leading to fund transfers from three different management accounts. The stolen tokens remain in a single wallet, with no observed attempts to swap or liquidate the assets.
UPCX suspends deposits and transactions
UPCX confirmed it had detected unauthorized access and took immediate action by suspending deposits and withdrawals. The platform assured users that their personal funds were unaffected and stated that an internal investigation is ongoing.
The attack triggered a decline in UPC’s token price, which fell 7% from $4.06 to $3.77, according to CoinGecko.
As of press time, UPCX has not provided further details on potential remediation measures. The incident follows a broader trend of security vulnerabilities affecting crypto platforms, with attackers increasingly exploiting administrative functions to siphon funds.
The UPCX breach adds to the rising concerns in Web3 security, emphasizing the need for improved smart contract security and access controls to prevent future incidents.
