What happened
On March 5, 2021, an attacker used a PAID Network proxy-admin key to take control of the token's upgrade path. The attacker replaced the audited implementation with malicious code, burned roughly 60 million PAID, minted 59.47 million new PAID, and sold about 2.4 million of the newly minted tokens on Uniswap for approximately $3 million in ETH. This was a privileged-key and upgrade-control compromise, not a vulnerability in the audited PAID token implementation.
PAID halted liquidity and migrated/restored holder balances using a pre-attack snapshot; no recovery of the attacker's realized ETH proceeds was confirmed.
A single proxy-admin key could replace the audited token implementation with arbitrary mint-and-burn logic.
Case & protocol details
Attack Timeline
The PAID token was upgradeable through a proxy controlled by a single privileged key. Once the attacker controlled that key, they changed the implementation to one with arbitrary burn and mint functions. Burning existing supply created room under the cap; minting placed new PAID under attacker control; selling those tokens into Uniswap extracted ETH before liquidity was pulled.
The security failure was concentrated upgrade authority and key management.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Post-Mortem paidnetwork.medium.com
- report Post-mortem rekt.news
- report Post-mortem rekt.news
- report PAID Network releases exploit post-mortem beincrypto.com
- transaction Transaction etherscan.io
- analysis PAID Network Post Mortem certik.com
- analysis Hacker performs $3 million attack on PAID Network cryptobriefing.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.