US Permissionless Dollar (USPD) hack — December 2025

USPD, an over-collateralised stablecoin protocol on Ethereum, was drained on 4 December 2025 through a backdoor planted eleven weeks earlier. On 16 September 2025, in a gap of about three blocks (roughly 36 seconds) between USPD deploying an upgradeable proxy and initialising it, an attacker front-ran the initialisation with a Multicall3 bundle and installed a CPIMP shim. The shim forwarded calls to the audited implementation while keeping a hidden admin slot and a second, attacker-controlled implementation pointer, and reset the initialisation flag so the team's own setup transaction still succeeded. Block explorers showed the legitimate contract. Audits by Nethermind and Resonance, completed on 20 August 2025, covered the code, not the deployment.

At 18:08 UTC on 4 December the attacker called upgradeAndCall through the shim, swapped in logic with the collateral checks removed, took a 3,121.95 WETH flash loan from Balancer to mint USPD, and moved roughly 237 stETH out of the protocol's escrow contracts along with about $300,000 of USDC from the Curve USPD/USDC pool. At that day's ETH reference price of about $3,189 this gives a loss of roughly $1.06m, consistent with contemporary reporting on 5 December of "over $1 million". Press accounts describe about 98 million USPD minted; mint volume is not a measure of the loss, because the bulk of the minting was flash-loan cycling repaid within the same transaction.

USPD offered a 10% bug bounty in exchange for the return of the funds, filed a report with the FBI and engaged SEAL 911. Nothing was returned. The attacker deposited proceeds into Tornado Cash on 8 December and continued swapping through the Curve pool until at least 17 December, so the final total is somewhat above $1.06m, but no published source has quantified the additional amount. V1 was wound down and about 230 affected holders received recovery tokens rather than reimbursement, with a V2 targeted for Q2 2026.