{"investigation":{"slug":"upcx","entity_name":"UPCX","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"UPCX is a blockchain payment protocol that suffered a $70 million exploit on April 1, 2025, when an attacker compromised an administrative private key and used it to push a malicious smart contract upgrade, draining 18.4 million UPC tokens from management accounts. The attack was enabled by the absence of multisig controls on privileged protocol functions, despite having undergone CertiK and Cyberscope audits that did not catch the operational key management risk. Despite listing on a Japanese FSA-licensed exchange just 11 days prior, no recovery of stolen funds was reported.","sections":[{"content":"UPCX is a high-performance open-source payment platform and blockchain designed for fast cross-border payments, DeFi integration, and programmable financial products. The project targets Web3 payment infrastructure with features including a multi-asset wallet, merchant payment tools, and smart contract capabilities. The UPC token serves as the native utility and governance token. UPCX listed on BitTrade, a Japanese FSA-licensed exchange, on March 27, 2025, signaling regulatory engagement in Japan.","heading":"Protocol Overview","sources":[{"url":"https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","name":"globenewswire.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 1, 2025, an attacker gained unauthorized access to a UPCX administrative private key. Using this key, the attacker pushed a malicious upgrade to the ProxyAdmin smart contract and invoked a withdrawByAdmin function to drain approximately 18.4 million UPC tokens from three management accounts. The exploit was first detected by on-chain security firm Cyvers. UPCX immediately halted transactions and launched an investigation. The stolen tokens were worth approximately $70 million at the time of the attack based on UPC's market price.","heading":"April 2025 Exploit — $70M Private Key Compromise","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/upcx-halts-transactions-after-70-million-hack-exposes-vulnerabilities/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://coinjournal.net/news/blockchain-payments-platform-upcx-exploited-for-70m/","name":"coinjournal.net","type":"other","credibility":3}],"severity":"medium"},{"content":"The attack was enabled entirely by the absence of multisig or MPC controls on the most privileged protocol functions. A single private key had the authority to upgrade smart contracts and withdraw funds from management accounts — a critical operational security failure. Smart contract audits by CertiK and Cyberscope did not identify or flag this key management risk. The attack did not require any exploit of contract logic; it required only possession of the admin key.","heading":"Root Cause — Missing Multisig Controls","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/upcx","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://blog.ueex.com/crypto-hacks/upcx-hack/","name":"blog.ueex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"UPCX had been actively pursuing regulatory compliance in Japan, completing the requirements to list on BitTrade, one of 16 FSA-licensed Japanese cryptocurrency exchanges. The listing occurred on March 27, 2025 — just 11 days before the April 1 exploit. The proximity of the regulatory milestone to the hack raised questions about the depth of security vetting involved in the exchange listing process. The FSA compliance focus did not translate to adequate smart contract operational security.","heading":"Japan FSA Compliance and Pre-Hack Timeline","sources":[{"url":"https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/hacker-steals-dollar70-million-in-upc-tokens-after-gaining-control-of-upcx-smart-contract","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The UPCX team is publicly identified, distinguishing it from many DeFi projects with anonymous leadership. Key executives include Yutaka Imaizumi (CEO), Joerg Alexander (CTO), and Dr. Jason Nye (CSO). Their professional backgrounds are verifiable. The project has published technical documentation and whitepaper. Despite public team identities, the critical operational security failure — a single-key admin control — represents a fundamental governance and security lapse.","heading":"Team and Background","sources":[{"url":"https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","name":"globenewswire.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the April 1, 2025 exploit, the stolen tokens remained in a single Ethereum wallet unmoved at the time of initial detection. No public bounty offer, recovery negotiation, or law enforcement coordination was announced. The protocol announced transaction suspension pending investigation. By July 2025, a press release reported staking activity surpassing 975,000 tokens, suggesting partial resumption of operations — though the $70M in stolen funds remained unrecovered.","heading":"Post-Exploit Status and Recovery","sources":[{"url":"https://www.globenewswire.com/news-release/2025/07/15/3115534/0/en/UPCX-Staking-Surpasses-975-000-Tokens-as-Web3-Payment-Ecosystem-Accelerates-Expansion.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/hacker-steals-70-million-upc-214926542.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT has flagged UPCX. The $70 million private key compromise represents one of the largest single-incident losses in the April 2025 crypto hack landscape. The absence of multisig on admin functions, the failure of two audits to flag this risk, and the lack of public recovery efforts combine to produce a high-risk profile. Despite a publicly identified team and Japan FSA engagement, the operational security failure was catastrophic. Users should treat any re-engagement with UPCX with extreme caution until comprehensive security upgrades are publicly verified.","heading":"ZachXBT Flag and Risk Assessment","sources":[{"url":"https://skynet.certik.com/projects/upcx","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-03-17","event":"UPCX announces listing on BitTrade, a Japanese FSA-licensed exchange.","source":""},{"date":"2025-03-27","event":"UPCX UPC token goes live on BitTrade exchange in Japan.","source":""},{"date":"2025-04","event":"Attacker compromises admin private key, pushes malicious ProxyAdmin upgrade, drains ~18.4M UPC (~$70M) from three management accounts.","source":"","date_original":"2025-04-01"},{"date":"2025-04","event":"Cyvers detects the exploit; UPCX halts all transactions and announces investigation.","source":"","date_original":"2025-04-01"},{"date":"2025-07-15","event":"UPCX press release reports staking activity resuming, surpassing 975,000 tokens. Stolen funds unrecovered.","source":""}],"sources_used":[{"url":"https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260519151718/https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","credibility":3,"archive_timestamp":"2026-05-19T15:17:18+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260422232356/https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","credibility":3,"archive_timestamp":"2026-04-22T23:23:56+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415070834/https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","credibility":3,"archive_timestamp":"2026-04-15T07:08:34+00:00"},{"url":"https://cryptoslate.com/upcx-halts-transactions-after-70-million-hack-exposes-vulnerabilities/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260510112137/https://cryptoslate.com/upcx-halts-transactions-after-70-million-hack-exposes-vulnerabilities/","credibility":3,"archive_timestamp":"2026-05-10T11:21:37+00:00"},{"url":"https://coinjournal.net/news/blockchain-payments-platform-upcx-exploited-for-70m/","name":"coinjournal.net","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://skynet.certik.com/projects/upcx","name":"skynet.certik.com","type":"other","archive_url":"http://web.archive.org/web/20260422203330/https://skynet.certik.com/projects/upcx","credibility":3,"archive_timestamp":"2026-04-22T20:33:30+00:00"},{"url":"https://blog.ueex.com/crypto-hacks/upcx-hack/","name":"blog.ueex.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/academy/article/hacker-steals-dollar70-million-in-upc-tokens-after-gaining-control-of-upcx-smart-contract","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260207232606/https://coinmarketcap.com/academy/article/hacker-steals-dollar70-million-in-upc-tokens-after-gaining-control-of-upcx-smart-contract","credibility":3,"archive_timestamp":"2026-02-07T23:26:06+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/07/15/3115534/0/en/UPCX-Staking-Surpasses-975-000-Tokens-as-Web3-Payment-Ecosystem-Accelerates-Expansion.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260608060635/https://www.globenewswire.com/news-release/2025/07/15/3115534/0/en/UPCX-Staking-Surpasses-975-000-Tokens-as-Web3-Payment-Ecosystem-Accelerates-Expansion.html","credibility":3,"archive_timestamp":"2026-06-08T06:06:35+00:00"},{"url":"https://finance.yahoo.com/news/hacker-steals-70-million-upc-214926542.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260829225623/https://finance.yahoo.com/news/hacker-steals-70-million-upc-214926542.html","credibility":3,"archive_timestamp":"2026-08-29T22:56:23+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:24.636045+00:00","updated_at":"2026-08-29T23:26:12.748811+00:00"}}