Pull up DefiLlama's stablecoin list today and you will find a token called US Permissionless Dollar sitting at $98,934,783 in circulating supply. Seven days ago the same tracker had it at $357,682. That is a jump of roughly 27,500% in a week, which would make it one of the fastest-growing dollar tokens in crypto.
It is nothing of the sort. Almost every one of those tokens was minted by an attacker who took control of the contract on the day it was deployed, then waited 78 days before doing anything with it.
What the numbers actually show
DefiLlama tracks USPD under asset ID 315 and flagged it
deadFrom: 2025-12-04. Its historical supply chart
stops on that exact date, at $480,290 on Ethereum plus $10 on
Base. The live list endpoint, though, keeps reading the token's
on-chain total supply, and that figure now includes the 98
million USPD created during the exploit. Two parts of the same
dashboard disagree by two orders of magnitude.
USPD reported circulating supply
Source: DefiLlama stablecoins API, asset 315, retrieved August 11, 2026. Log scale.
None of this is DefiLlama hiding anything. The dead flag is public and the chart plainly ends in December. But the summary row is what feeds screeners, bots, and the "top gainers" widgets people actually look at, and that row says a nine-figure stablecoin grew 27,500% this week.
The 24 seconds that cost $1 million
USPD was built by the team behind Morpher, a decentralized trading platform. The design is a familiar one: deposit ETH, the contract converts it to stETH, and you get a dollar token backed by roughly 4% staking yield with a 125% minimum collateralization ratio enforced by third-party operators the protocol calls Stabilizers. Nethermind and Resonance Security both audited the code, and both audits held up.
The deployment is where it went wrong. On September 16, 2025, USPD pushed its proxy contract on-chain at 9:01:59 and sent the initialization transaction separately. Twelve seconds later, at 9:02:11, an attacker initialized it first. The legitimate transaction landed at 9:02:35, twenty-four seconds too late, into a contract that already had a new owner.
🎭 What a CPIMP actually is
Dedaub named it CPIMP — Clandestine Proxy In the Middle of Proxy. An upgradeable contract stores the address of the code it runs in a storage slot. If the contract is deployed in one transaction and configured in another, anyone watching the mempool can slip into the gap and write their own address into that slot.
The clever part is what goes in. Instead of replacing the protocol's logic, the attacker inserts a middleman that passes almost every call straight through to the real audited implementation. Deposits and withdrawals keep functioning exactly as documented. The middleman also rewrites itself back into the implementation slot after each call, so upgrades do not dislodge it, and it spoofs storage reads and event logs so Etherscan keeps displaying the legitimate contract.
On September 17 the attacker granted a second contract privileged roles and then went quiet. The protocol launched. People deposited. Supply climbed from about $228,000 in late November to $480,000 by December 1. Then on December 4 the backdoor was used: 98 million USPD minted out of nothing, 232 stETH drained, roughly $1 million gone. By December 8 around 330 ETH had moved through Tornado Cash.
Two attacker addresses worth knowing
Security researchers separated the roles. The infector address
0x7C97313f349608f59A07C23b18Ce523A33219d83 did the
September front-run. The drainer
0x083379BDAC3E138cb0C7210e0282fbC466A3215A executed
in December. Splitting the two makes the September activity look
like unrelated noise for anyone auditing the deployment months
later.
USPD's own summary of the incident was that "this was not a flaw in our smart contract logic." Read narrowly, that is true. The audited Solidity did what it was supposed to do. Read as a defense, it does not hold up, because CPIMP was not a novel technique in September 2025. It had been public for two months.
The warning nobody applied
David Benchimol at Venn found the pattern on July 8, 2025, after a colleague, Ruslan Kasheparov, flagged odd proxy initializations. What followed was a 36-hour war room run with Dedaub and SEAL 911 that swept dozens of contracts across Ethereum, BNB Chain, Arbitrum, Base, Berachain, Scroll and Sonic. EtherFi, Pendle, Orderly Network, Origin, KIP Protocol and Myx were among those found infected or exposed. Published accounts put the value protected above $10 million. An earlier Kinto Protocol compromise in March 2025 had followed the same shape, with the attacker taking control roughly two seconds after deployment.
So the vulnerability class had a name, a writeup, a coordinated industry response, and a list of victims — and USPD deployed into it anyway, ten weeks later. That is the part I would hold against the team more than the theft itself. A zero-day is bad luck. Walking into a bug class that had its own industry-wide emergency response a quarter earlier is a process failure, and it happened at the one moment an audit report does not cover.
The fix is one line of deployment code.
Nethermind's guidance is to pass initialization data through
the _data parameter of the
ERC1967Proxy constructor so deploy and initialize
happen in a single transaction, closing the window an attacker
needs. Where
that is impossible, lock down initialize() with
strict access control and use CREATE2 to precompute addresses.
What this changes for people who use dashboards
Most readers here are never going to deploy a proxy contract. The useful takeaway is about the numbers you do look at.
| Signal people trust | What it failed to catch at USPD |
|---|---|
| "Audited by Nethermind and Resonance" | Both audits reviewed source code. Neither covered how the contract was put on-chain, which is where the compromise happened. |
| "Verified on Etherscan" | The malicious middleman spoofed storage slots and events so explorers kept rendering the legitimate implementation address for 78 days. |
| Rising circulating supply | A supply chart measures tokens issued, not dollars backing them. Unauthorized mints show up as growth. |
| On-chain proof of reserves | Reserve dashboards read the same contract the attacker controlled. A proof is only as honest as the thing reporting it. |
There is a version of this that gets expensive for ordinary users. Say a token like USPD stays listed on aggregator sites with a nine-figure supply number attached. A yield aggregator sizes a position off that number. A screener flags it as a top weekly gainer. Someone bridges in looking for the 4% staking yield the marketing page still advertises. The supply figure did the damage, not the exploit.
Two checks cost you nothing. Before you park money in a smaller stablecoin, compare its supply against something that measures money rather than tokens — TVL of the actual collateral, or the stETH balance held by the vault address. If those two lines diverge sharply, the token supply is telling you a story the collateral cannot support. And read the aggregator's own status flags. DefiLlama had marked USPD dead eight months before that $98.9 million figure showed up in its list.
Where USPD stands now
The team offered the attacker a 10% bounty for returning the funds, which was declined in practice — the ETH went through Tornado Cash within four days. USPD sunset its v1 beta and has pointed to a v2 with a recovery pool for affected holders. DefiLlama no longer reports a price for the token at all, which is its own kind of answer.
Nethermind's writeup ends with a line worth taping to a monitor: "Secure deployment is not a follow-up task. It is part of the security boundary." For everyone else, the version that matters is simpler. A number on a dashboard is a measurement, and measurements can be manufactured. Before that number moves your money, find out what it is counting.
Nethermind's technical breakdown of the CPIMP attack and Dedaub's account of the July 2025 mitigation effort are both worth reading in full.