UPCX Hack
Reported loss
$70.0M
Upgraded ProxyAdmin + withdrawByAdmin Hack
What happened
UPCX reported unauthorized activity involving management accounts on 1 April 2025. Cyvers traced transfers of about 18.4 million UPC, estimated at roughly $70 million, following an administrative upgrade, according to Cyvers.
Technical root cause
Privileged administrative operations enabled the upgrade and fund withdrawals. Cyvers said the root cause remained under investigation; the report does not establish how the attacker obtained that authority.
How it happened
- An unauthorized party used a privileged UPCX address.
- Cyvers reported an administrative upgrade followed by execution of an admin-only withdrawal function.
- About 18.4 million UPC moved from three management accounts; UPCX suspended deposits and withdrawals.
Protocol details
Classification
Protocol Logic / Other / Access Control
Protocol Type
Exploit/Access control
Implementation language
Solidity
Protocol links
Website
@Upcxofficial
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
