On April 1st, UPCX, an open-source payment platform, detected unusual activity pertaining to one of its core smart contracts. The system flagged a series of suspicious transactions originating from wallets linked to the project’s leadership.
Specifically, an unauthorized party gained control of wallet address 0x4C………3583E and subsequently transferred over 18 million UPC tokens, worth an estimated $70 million, to the attacker’s designated wallet.
UPCX Losses $70 Million From Breach
According to reports from Cyvers, a blockchain security firm, the hacker upgraded the “ProxyAdmin” contract. This allowed the hacker to execute the ‘withdrawByAdmin’ function, which led to the successful transfer of a sum from three different management accounts. The stolen sum was moved to a new wallet address, 0xFf7….334, where it is kept for now.
The UPCX payment platform acknowledged the breach, and the team was forced to halt all deposits and withdrawals and notify users about the breach. The team is currently carrying out critical investigations on the issue.
Meir Dolev, co-founder and chief technology officer of Cyvers, confirmed that the investigation into the attack’s root cause is still ongoing. However, he noted that these events frequently arise from compromised credential or inadequate access control systems.
Dolev further stated that these vulnerabilities have significantly contributed to the losses in Web 3 throughout 2024. The executive mentioned that the same issues accounted for more than 80% of the stolen assets over the course of the year. Dolev also emphasized that the breach highlighted a pressing necessity to improve safeguards concerning wallet authorization and live transaction verification.
Market Effect on UPC Token
Following the heist, the UPC token fell sharply. At the time of writing, data from CoinGecko shows a dip of 4.1% from $4.02 to $3.85. A week ago, UPC price reached an all-time high of $5.37 on March 24, 2025, according to data from CoinGecko.
The UPCX team is working hard to resolve the issue quickly and prevent future attacks. Meanwhile, the team assures the community that all users’ funds are safe.
Despite the incident, UPC continues to trade on Gate.io, MEXC, Bitget and other platforms though with limited liquidity pools. The incident is a grim reminder of the significant challenges facing the blockchain and Defi ecosystem.
