Hacker Moves $70 Million From Payment Platform UPCX

A hacker has executed a malicious withdrawal of funds worth millions of dollars in crypto assets from the blockchain-based, open-source payment platform, UPCX. Blockchain security firm Cyvers revealed that the hacker transferred over 18.4 million UPC tokens worth approximately $70 million.

UPCX Suffers $70M Loss

According to Cyvers, the hacker had gained access to the platform’s key account address and upgraded the ProxyAdmin contract, which gave the attacker access to execute the withdrawByAdmin function. They quickly transferred the funds from three different management accounts.

Following the incident, UPCX noted that users’ assets are unaffected, all funds in the address are safe, and no swaps were detected at the time of writing. Additionally, the team has temporarily suspended UPCX deposits and withdrawals. 

In response to the hack, the team assured users that it is actively working to investigate the incident and will provide feedback as soon as possible. It added that the security of the platform is a priority.

UPCX reached 50,000 users in December 2024 and surpassed 100,000 later that month. The platform includes a user-friendly interface. Its various support payment methods, such as QR codes and NFC technology, have driven its growing adoption, while its offline payment capacities ensure transactions in locations with unstable electricity. 

Exploits on DeFi Platforms 

Moreover, security breaches like this are not entirely new to crypto sector. On March 25, 2025, DeFi protocol DMX revealed it had lost 6,260 ETH, valued at approximately $13 million, to a security breach. The project’s team noted that the exploit only affected the Abracadabra/Spell’s cauldrons contracts.   

In related news, on March 18, 2025, memecoin generator Four.Meme, built on the BNB chain, also experienced a security breach that resulted in the loss of roughly 200 BNB, valued at approximately $130,000. According to the report, the hacker acquired a small number of tokens and exploited Four. Meme’s function to transfer them to a non-existent trading pair address on the BNB Chain-based decentralized exchange, PancakeSwap.

Similarly, Crypto derivatives exchange Phemex suffered an exploit, which led to the loss of $24 million in crypto assets from the platform’s hot wallet. During the hack, the bad actors swapped the stolen funds for ETH to withdraw their proceeds. Withdrawals were temporarily suspended to ensure the security of user funds.