USPD stablecoin hacked for $1 million: Hacker strikes after lying low for 78 days

[Crypto World] The USPD stablecoin protocol was recently hacked, resulting in a loss of about $1 million.

This attack was quite cunning—the attacker started preparing two months in advance. The whole operation was carried out in two waves:

The first wave was on September 16, when the hacker front-ran the project’s initialization transaction and injected a malicious proxy contract into USPD’s stabilizer—this step went completely unnoticed. The next day (September 17), the attacker used this backdoor to grant special privileges to their own contract. Then came a long wait; after 78 days, on December 5, they suddenly struck.

Specifically, 232 stETH were siphoned off, and the attacker also minted 98 million USPD tokens. This method of attacking by tampering with storage data indicates a serious vulnerability in the contract’s permission management during the initialization phase.

Despite the two-month lurking period, the project team remained completely unaware. This case once again proves how important security audits are before deploying smart contracts, especially in critical areas like initialization logic and permission allocation—one careless mistake can leave a fatal backdoor.