UPCX Official loses $70M in UPC tokens after unauthorized smart contract access

The UPCX decentralized payment service suffered one of the more significant hacks of 2025. A malicious actor gained access to a smart contract, causing the startup to lose $70M in UPC tokens. 

UPCX, a Web3 payment service, lost $70M in UPC tokens after unauthorized access to one of the project’s smart contracts. The platform registered unusual activity around one of its main smart contracts. The system detected multiple suspicious transactions originating from some of the project’s wallets. 

After gaining access to one of the project’s addresses, the hacker upgraded the ProxyAdmin contract and used the privileges to withdraw 18.4M UPC, valued at $70M. According to Cyvers, the attacker used the ‘withdrawByAdmin’ function’ to order a single large-scale transaction of about 2.36% of the total token supply. The affected wallets belonged to the management of the UPCX project. 

User funds are safe, but the protocol stopped deposits and withdrawals. 

🚨Security Notice: Unauthorized Activity Detected🚨

UPCX has identified unauthorized activity involving our management account. As a precautionary measure, we are taking immediate action to ensure platform security.

🔹 UPCX deposits and withdrawals are temporarily suspended.
🔹…

— UPCX® Official (@Upcxofficial) April 1, 2025

The UPCX team is still investigating the exact nature of the hack and the movement of funds. After the exploit, the UPC tokens were parked in one address. UPC is still only traded on Gate.IO and Mexc, with limited liquidity pools. The project has been developing since late 2023 but only saw a boost in activity in the first quarter of 2025. However, it remains relatively unknown compared to other Web3 payment services.

Following the news of the exploit, the native UPC token fell by 5.1% to $3.52. The token recently traded near an all-time high, as the project aimed to attract attention to its products and newly launched main net. The product started trading on more niche markets in just the past week. UPCX targets the Southeast Asian market and aims to gain listings in Japan.

The major part of the losses from the hack are due to the recent UPC token rally. Based on its current valuation, this made the asset more attractive to hackers. UPC only started rallying in March, peaking at $5.31. The loss of token value additionally broke down the project. 

Despite having a native wallet and chain, UPCX still mostly relies on the Ethereum ecosystem. The token is spread to over 40K wallets, with the UPCX blockchain still aiming to gain more users. The flawed smart contracts and project wallets are also based on Ethereum. The recent hack led to an outflow of users, with hundreds of wallets emptying out their UPCX balance. 

UPCX may see major selling pressure

The recent hack has affected the UPC token, which has an extremely low float. Only around 4.14M tokens were in circulation at the time of the hack. More than 50% of tokens are held in one cluster, with other large-scale wallets belonging to the team. 

The total supply of tokens is 780M, to be released over the next few years. This makes the recent hack especially influential if the attacker tries to swap out the funds. Most of the team, early backers, and ecosystem tokens are still vested, with slow unlocks coming in 2025. 

Following the exploit, the hacker’s wallet is the seventh largest among all owners. All the stolen UPC were still held in the wallet for hours after the initial transaction, as the token offered limited opportunities for swapping or trading. 

The hacker’s wallet is newly created, and the UPC transaction is the only inflow of funds, with the exception of a test transaction for 10 UPC minutes before the main exploit. The wallet did not even add ETH for gas fees. It directly interacted with the token contract and simply assigned the transfer of UPC, with no intermediary steps and a minimal gas fee.

Cryptopolitan Academy: Tired of market swings? Learn how DeFi can help you build steady passive income. Register Now