SmartCash narxSMART

The open-source payment platform UPCX suspended transactions following an unauthorized withdrawal of approximately $70 million in digital assets. Blockchain security firm Cyvers identified the breach on April 1, flagging suspicious activity involving 18.4 million UPC tokens. Cyvers reported that an attacker gained control of a UPCX administrative wallet and modified its ProxyAdmin contract. This enabled the execution of a withdrawal function, leading to fund transfers from three different management accounts. The stolen tokens remain in a single wallet, with no observed attempts to swap or liquidate the assets. UPCX confirmed it had detected unauthorized access and took immediate action by suspending deposits and withdrawals. The platform assured users that their personal funds were unaffected and stated that an internal investigation is ongoing. 🚨Security Notice: Unauthorized Activity Detected🚨 UPCX has identified unauthorized activity involving our management account. As a precautionary measure, we are taking immediate action to ensure platform security. 🔹 UPCX deposits and withdrawals are temporarily suspended. 🔹… The attack triggered a decline in UPC’s token price, which fell 7% from $4.06 to $3.77, according to CoinGecko . As of press time, UPCX has not provided further details on potential remediation measures. The incident follows a broader trend of security vulnerabilities affecting crypto platforms, with attackers increasingly exploiting administrative functions to siphon funds. The UPCX breach adds to the rising concerns in Web3 security , emphasizing the need for improved smart contract security and access controls to prevent future incidents.

As Bitcoin flirts with near-term lows under $80,000, Fundstrat co-founder and managing partner Tom Lee believes the digital asset is setting up for a strong second half of the year. In an interview with CNBC, Lee said that despite recent price weakness , current conditions offer a good entry point for long-term investors. “I think so,” Lee replied when asked if now is a good time to be “stacking” Bitcoin ( BTC ). “Part of this was that Bitcoin seasonally was just not going to be attractive until after March ends. And now we’re finally exiting March.” Lee pointed to macroeconomic and political catalysts that suggest “the calendar is looking better”. This could help Bitcoin rally through the end of the year. Notably, the Federal Reserve and central banks are easing and quantiativetightening is ending. Coupled with “positive Washington tailwinds,” Bitcoin “can do well until the end of the year.” Lee reiterated his long-standing bullish outlook on Bitcoin, maintaining a year-end target of at least $150,000. “I know it doesn’t feel like it, but once we get through this [Trump’s] tariff agenda, markets can look forward to things that could be positive,” he explained. On the topic of the U.S. dollar and crypto’s role in global markets, Lee agreed with recent comments from BlackRock CEO Larry Fink, who warned that U.S. protectionist policy could undermine the dollar’s strength. However, Lee believes that smart stablecoin regulation could actually protect the dollar’s dominance. “In crypto, when it comes to stablecoins, the dollar is way more dominant there than it is in traditional markets,” he said. “So I think you actually kind of protect the dollar with stablecoin legislation.” As April begins, Lee’s message to investors is clear: the worst may be behind us, and the path forward could lead to new all-time highs.

Privacy-focused infrastructure provider 0xbow has launched Privacy Pools, a new blockchain tool that lets users protect their transaction history while attempting to follow the law. On a Mar. 31 post on X, 0xbow announced the mainnet launch, stating that Ethereum ( ETH ) users can now achieve on-chain privacy while avoiding illicit funds. Privacy Pools use zero-knowledge proofs to enable private ERC-20 token transfers. gm Ethereum ☀️ It is our great honor to announce the mainnet launch of Privacy Pools! ETH users can now achieve on-chain privacy, while still dissociating from illicit funds It is now up to all of us to Make Privacy Normal Again 🫡 More info in this thread 👇 pic.twitter.com/3nJO0AxoD1 Unlike earlier privacy mixers, this tool screens deposits to prevent stolen or illicit funds from entering the system. Ethereum co-founder Vitalik Buterin is one of the co-authors of the initial Privacy Pools research paper and has publicly supported the project. Following the mainnet launch, Buterin was among the first to deposit ETH into the pool. The system works through “Association Sets,” which batch transactions while verifying they aren’t linked to hackers, scammers, or other bad actors. If a deposit is later flagged, it can be removed without affecting others in the pool. If a user’s deposit doesn’t pass the screening process, they can withdraw their funds back to their original wallet through a “ragequit” function, making Privacy Pools a non-custodial solution. According to 0xbow, Privacy Pools had already processed more than 21 ETH from 69 deposits. The initial deposit cap is set at 1 ETH. However, as the system is tested further, the cap will be raised. In recent years, privacy tools have faced regulatory pressure due to concerns over illegal use. A major obstacle has been striking a balance between user privacy and legal compliance. Several countries have taken action to limit the use of privacy coins like Monero and Zcash due to their growing use in criminal activity. In the most well-known case, Tornado Cash was sanctioned by the Office of Foreign Assets Control of the U.S. Treasury for allegedly facilitating illicit transactions. However, a U.S. appeals court ruled in November 2024 that the sanctions were unlawful and reversed them. According to the court’s ruling, Tornado Cash’s immutable smart contracts do not qualify as “property” that can be seized, and the penalties were unfairly imposed on a decentralized protocol. Whether 0xbow’s new strategy will meet global regulatory requirements is still unknown.

After losing its entire total value locked to an exploit, decentralized finance protocol SIR.trading has offered the attacker a $100K bounty to return the remaining funds. On March 31, Xatarrer, the anonymous creator behind the Ethereum-based platform, made a direct on-chain plea to the hacker. In the message , they asked the attacker to keep $100,000, which accounts for roughly 28% of the stolen funds, as a “fair share” for finding a critical vulnerability, vowing that no legal action would be pursued if the remaining funds were returned. Xatarrer said the project was built from scratch over four years with late-night coding sessions and $70,000 pooled from friends and supporters. With no backing from venture capital firms, the protocol had grown organically to around $400,000 in TVL before the exploit drained it all. “If you keep 100% of the funds, there is no chance for us to survive,” they added. Xatarrer also acknowledged the skill involved in the exploit, calling the attack “almost beautiful if it wasn’t for all the funds people lost.” So far, there’s been no response from the attacker. According to Etherscan data, the stolen crypto has already been funneled through Railgun, a privacy protocol that obscures transaction trails. SIR.trading, also known as Synthetics Implemented Right, was exploited on March 30 , after a vulnerability in one of its core smart contracts led to the protocol’s entire TVL being drained. The vulnerability was linked to a function in the protocol’s smart contract called uniswapV3SwapCallback, which is part of the Vault contract. According to experts, the vulnerability involved Ethereum’s transient storage, a feature introduced in the Dencun upgrade to help reduce gas fees. The attacker manipulated the transient storage before the transaction ended, using it to overwrite security data mid-process. This allowed them to trick the contract into accepting a fake Uniswap pool address controlled by the attacker. Following the incident, Xatarrer said they still hope to rebuild the protocol. In their latest message to the community on X, the founder added that the team had already started “planning” the next steps for the protocol. The wounds are still fresh, but we’ve already started planning our next steps. Those impacted by the hack will not be forgotten. Thank you to everyone who provided feedback and support during these difficult times. pic.twitter.com/mGk7eLWiXy The SIR.trading exploit adds to a growing list of crypto security incidents this year. Last month, Starknet-based layer 2 money-market protocol zkLend lost over $9 million worth of Ethereum in an exploit. February proved especially brutal, with losses from hacks and scams topping $1.5 billion, according to a March 5 report from blockchain security firm Certik.

The crypto market witnessed over 60 crypto hacks in Q1 resulted in $1.63 billion in losses, more than doubling from $706 million a year earlier. Crypto hacks in the first quarter of 2025 resulted in more than $1.6 billion in losses, making it the worst quarter for crypto security breaches to date, per data from Immunefi’s latest research report . Data from PeckShield also shows that crypto losses from hacks in Q1 more than doubled from $706 million in Q1 2024. #PeckShieldAlert Q1 2025 witnessed 60+ crypto hacks, resulting in total losses of $1.63B, a YoY increase of 131% compared to $706M in Q1 2024. March 2025 recorded 20 crypto hacks, resulting in $33.46M in losses, including a $5M hack affecting #1inch , which was 90% recovered.… pic.twitter.com/Pg3fHpUvUp Most of the losses in Q1 came from two major incidents: a $1.46 billion exploit at Bybit and a $69.1 million attack on Phemex . As analysts at Immunefi note, the two major exploits of the quarter “totaled $1.52 billion alone, accounting for 94% of all losses in Q1.” “The sheer scale of the Bybit and Phemex attacks, totaling $1.5 billion, shows how state-backed actors are arguably the most pressing threat to our industry. Their success in breaching renowned, battle-tested platforms is a reminder of the need for security measures that protect the entire stack and help projects prevent catastrophic attacks before they happen.” Immunefi Centralized exchanges suffered the most as they accounted for 94% of total losses, while attacks on decentralized finance accounted for just 6%. Binance’s BNB Chain (formerly Binance Smart Chain) was the most exploited blockchain, suffering 19 separate incidents, followed by Ethereum with 15, the data shows. March alone saw 20 hacks, resulting in $33.46 million in losses, with the largest incidents included a $13 million exploit at Abracadabra.money and an $8.32 million attack on Zoth.