The US Permissionless Dollar (USPD) hack involved an attacker exploiting a proxy vulnerability to mint 98 million unauthorized tokens, draining over $1 million in liquidity from the DeFi protocol. The breach, detected in December 2025, highlighted risks in proxy initialization during deployment.
-
Attack Details: The hacker used a Clandestine Proxy In the Middle of Proxy (CPIMP) method to gain hidden admin rights.
-
Unauthorized Minting: Approximately 98 million USPD tokens were created against a 3,122 ETH deposit, far exceeding the collateral value.
-
Impact and Response: Liquidity loss exceeded $1 million, with USPD team issuing warnings and offering a 10% bounty for fund recovery; trading volume dropped 20% to $2.56 million.
Discover the USPD hack details: how a proxy exploit led to $1M+ losses in this DeFi stablecoin breach. Learn prevention tips and recovery efforts now.
What is the US Permissionless Dollar Hack?
The US Permissionless Dollar (USPD) hack refers to a sophisticated security breach in the decentralized finance protocol that occurred in December 2025, where an attacker exploited a deployment vulnerability to mint unauthorized stablecoins and drain liquidity. The incident resulted in the creation of about 98 million USPD tokens using just 3,122 ETH in collateral, enabling the theft of over $1 million, including 237 stETH. The protocol’s team quickly identified the issue and advised users to revoke approvals to mitigate further risks.
How Did the Attacker Exploit Proxies in the USPD Hack?
The attacker in the USPD hack employed a complex technique known as Clandestine Proxy In the Middle of Proxy (CPIMP) to front-run the proxy initialization during the protocol’s deployment on September 16, 2025. By using a Multicall3 transaction, the hacker inserted a shadow contract that mimicked the audited code, allowing silent seizure of administrative rights. This deception involved event payload manipulation and storage slot spoofing, which tricked verification tools like Etherscan into displaying the original secure contract, enabling the exploit to remain undetected for months.
Blockchain security experts, including those from PeckShield, confirmed the breach’s mechanics, noting that the shadow implementation forwarded calls to the legitimate USPD code while subtly altering outcomes. As detailed in the protocol’s incident report, the attacker waited patiently before upgrading the proxy to mint the excessive tokens and withdraw collateral. This attack vector underscores the vulnerabilities in proxy-based upgrades, even in rigorously audited systems.
According to analysts like Emmet Gallic, the proxy initialization flaw during deployment was pivotal, allowing the hacker to install the deceptive contract without triggering alarms. The USPD team emphasized that their smart contract logic passed audits by firms such as NethermindEth and Resonance, with full unit testing and adherence to industry standards. Despite these measures, the emerging CPIMP method bypassed traditional safeguards, highlighting the need for enhanced deployment monitoring in DeFi protocols.
2/ This was not a flaw in our smart contract logic.
The USPD protocol underwent rigorous security audits by top-tier firms NethermindEth and Resonance. Our code is fully unit-tested and adheres to strict industry standards. The logic itself remains secure.
— USPD.IO | The Dollar of the Decentralized Nation (USPD_io) December 4, 2025
The protocol’s report further explained that the camouflage enabled the attacker to operate undetected, only activating the exploit when conditions aligned. This incident serves as a cautionary tale for DeFi projects relying on proxy patterns, prompting calls for advanced front-running protections and multi-signature deployment processes.
Frequently Asked Questions
What Caused the Unauthorized Minting in the USPD Stablecoin Hack?
The unauthorized minting in the USPD hack stemmed from a CPIMP exploit during proxy deployment, where the attacker front-ran initialization to install a shadow contract. This allowed minting 98 million tokens against minimal collateral, draining 237 stETH and converting stolen assets to USDC via Curve, totaling over $1 million in losses.
How Is the USPD Protocol Responding to the Hack and Recovering Funds?
The USPD team is collaborating with law enforcement and whitehat security groups to trace stolen funds, flagging attacker addresses on major centralized and decentralized exchanges. They offered a 10% bug bounty for returning 90% of assets, promising to halt legal actions upon compliance. Investigations continue to secure the protocol and prevent future breaches.
Despite the incident, USPD’s peg to the U.S. dollar remains intact, though trading volume fell 20% to $2.56 million in the last 24 hours, per CoinMarketCap data.
This breach echoes larger DeFi incidents, such as the 2023 Euler Finance hack that resulted in $197 million losses from drained stablecoin pools. In November 2025, Yearn Finance faced two exploits on its yETH token, losing $3 million initially but recovering $2.39 million for depositors. Balancer also announced reimbursements of $8 million to liquidity providers after a $128 million v2 vulnerability exploit.
Key Takeaways
- Proxy Vulnerabilities Exposed: The USPD hack demonstrates how front-running in proxy initialization can enable hidden admin takeovers, emphasizing the importance of secure deployment practices.
- Swift Response Mitigates Damage: Immediate user warnings and fund freezing efforts limited broader impacts, with the protocol maintaining its dollar peg amid the crisis.
- Ongoing Recovery Efforts: Offering bounties and partnering with authorities provides a pathway to asset recovery; DeFi projects should prioritize advanced audit layers for emerging threats.
Conclusion
The US Permissionless Dollar hack reveals persistent risks in DeFi proxy mechanisms and the USPD stablecoin’s exposure to sophisticated attacks like CPIMP, despite robust audits from NethermindEth and Resonance. As the protocol advances investigations and pursues fund recovery through bounties and law enforcement collaboration, the incident reinforces the need for vigilant security in decentralized finance. Stay informed on evolving DeFi safeguards to protect investments in the growing stablecoin ecosystem.
