DeFi Protocol USPD Loses $1 Million in “CPIMP” Attack

The post DeFi Protocol USPD Loses $1 Million in “CPIMP” Attack appeared first on Coinpedia Fintech News

A decentralized finance platform called USPD has fallen victim to a complex security breach that resulted in approximately $1 million being stolen from its protocol. What first looked like a normal system setup months ago was actually a hidden trap waiting to strike. 

In the meantime, USPD is offering a 10% bounty if the attacker returns 90% of the stolen funds.

How the USPD Attack Happened?

According to blockchain security firm PeckShieldAlert, the attacker planted the trap all the way back on September 16, while the project was still being deployed. They used a clever technique during the proxy setup phase, gaining admin rights before USPD’s own deployment script could finish.

Meanwhile, this type of exploit is now being called a “CPIMP” attack, short for Clandestine Proxy In the Middle of Proxy.

What made this attack particularly sneaky was how well it was hidden. The hacker installed what security experts describe as a “shadow” implementation that cleverly forwarded everything to USPD’s properly audited contract. 

By manipulating event data and storage information, they tricked blockchain explorer Etherscan into showing the legitimate, audited code, even though they had secretly planted their malicious version underneath.

Attack Finally Strikes, Losing $1 Million

After months of lying dormant and undetected, the attacker finally struck. They upgraded the proxy contract, minted around 98 million USPD tokens out of thin air, and withdrew approximately 232 stETH tokens before draining nearly $1 million in liquidity

The attacker operated through two addresses, now labeled “Infector” address (0x7C9…19d83 and the other was “Drainer” address (0x0883…3215A).

10% Bounty For The Attacker

The USPD team is working with law enforcement and white-hat researchers to track the stolen funds. They have asked all users to revoke approvals to stay safe.

They also said they are open to treating the hack as a “white-hat rescue” if the attacker comes forward. 

To encourage this, USPD is offering a 10% bounty if the attacker returns 90% of the stolen assets.