365int
In a significant security breach, an unauthorized entity has siphoned approximately $70 million worth of digital assets from the open-source payment platform UPCX. The incident was flagged on April 1 by blockchain security firm Cyvers, which detected suspicious activity involving 18.4 million UPC tokens.
Details of the Breach
Cyvers reported that an unknown party accessed a UPCX address and upgraded its ProxyAdmin contract. This modification allowed the attacker to execute administrative functions, leading to fund withdrawals from three different management accounts. As of now, the stolen tokens have not been exchanged for other cryptocurrencies.
UPCX’s Response
In reaction to the breach, UPCX has suspended all deposit and withdrawal activities to prevent further unauthorized transactions. The platform has assured users that their assets remain unaffected and has initiated a thorough investigation into the incident. Despite these assurances, the value of UPC’s token experienced a 7% decline, dropping from $4.06 to $3.77.
Expert Insights
Meir Dolev, co-founder and chief technology officer at Cyvers, highlighted that the root cause of the attack is still under investigation. However, he noted that such incidents often result from compromised credentials or flawed access control mechanisms. Dolev emphasized that similar attack patterns have been observed in previous exploits, where access to critical administrative roles enabled malicious upgrades and fund drainage.
Industry Implications
This breach underscores the pressing need for enhanced security measures within the cryptocurrency sector. In March alone, the total value of crypto assets stolen through hacks reached $33 million. The UPCX incident more than doubles that figure, highlighting vulnerabilities that must be addressed to protect digital assets and maintain user trust.
