ChainBleedv0.1 · open intel
← back to feed·ACCESS-CONTROL2025-04-01 · 1y ago
Incident · SLOWMIST

UPCX

Unknown
Estimated loss
$70.00M
VERDICT —UNRATED
Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.
▰ METHOD
ACCESS CONTROL
ACCESS-CONTROLBYTECODE CATCHABLEAI SCANNABLE
Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

According to an announcement from blockchain payment platform UPCX, unauthorized activity was detected in its management accounts. As a precaution, the platform has urgently suspended UPC deposits and withdrawals. The official statement assures that user assets remain unaffected, and an active investigation is underway to determine the cause of the incident, with further updates to follow. Earlier reports suggested that an unauthorized party had accessed UPCX’s official addresses. The attacker allegedly transferred a total of 18.4 million UPC (approximately $70 million) from three management accounts. On April 4, UPCX posted on Twitter that, despite differing reports from various sources, the project still retains control over 18,473,290 UPC. While the suspicious activity remains under investigation, the project team will proceed with the transfer of the relevant UPC at approximately 09:00 UTC on April 4, 2025. Attack method (per SlowMist): Unknown. Reported loss: $ 70,000,000.

Primary source
https://x.com/Upcxofficial/status/1907024397497749647
Sourced from
slowmist
Technical record
chain
protocol
UPCX
bug_class
access-control
date_occurred
2025-04-01
loss_usd
$70,000,000
source_id
sm:upcx::2025-04-01
Related — same bug class· access-control
2026-05-13
28d ago
ARB
ShapeShift FOX Colony (Colony Network)
executeMetaTransaction → resolver-repoint via setTarget → delegatecall drain
access-control
$132.7K
AUDIT-CATCHABLE
2026-05-12
28d ago
ETH
BoostHook
Uniswap V4 hook-contract logic exploit
access-control
$47.5K
UNRATED
2026-05-12
29d ago
Aurellion Labs
Contract Vulnerability
access-control
$455.0K
UNRATED
2026-05-11
29d ago
POLY
Huma Finance V1 (deprecated)
refreshAccount() unconditional GoodStanding state flip → unauthorized drawdown
access-control
$101.4K
AUDIT-CATCHABLE
2026-05-10
1mo ago
ARB
Renegade
Unprotected Initializer Exploit
access-control
$209.0K
UNRATED
2026-05-10
1mo ago
ARB
Renegade
Contract Vulnerability
access-control
$209.0K
UNRATED
ChainBleed — live web3 threat intelligence