UPCX loses $70M in tokens after unauthorised access

The decentralised payment platform UPCX suffered a significant security breach on April 1, resulting in the loss of $70 million worth of its native UPC tokens.

Blockchain security firm Cyvers flagged the incident, revealing that an attacker exploited a vulnerability in the platform's administrative controls.

The hacker accessed a critical address within UPCX’s ecosystem and upgraded the "ProxyAdmin" contract.

Using an administrative function, the attacker withdrew 18.4 million UPC tokens from three management accounts.

The stolen tokens, valued at approximately $70 million, remain in a single wallet with no attempts to swap or liquidate them as of now.

In response to the breach, UPCX suspended all deposits and withdrawals while assuring users that their personal funds were unaffected.

The platform is conducting an internal investigation to determine the full scope of the incident.

"We are taking immediate action to ensure platform security," UPCX stated in a public announcement.

The hack caused a 7% drop in UPC’s token price, which fell from $4.06 to $3.77 during the incident.

The token had recently reached near all-time highs following increased activity on UPCX’s newly launched mainnet.

Security experts have linked the attack to broader vulnerabilities in Web3 platforms.

Cyvers co-founder Meir Dolev noted that such breaches often stem from compromised credentials or flawed access controls.

"This incident mirrors attack patterns we’ve documented in prior exploits, where access to critical administrative roles enabled malicious upgrades and fund drainage," Dolev explained.