In December 2025, USPD stablecoin protocol was exploited through its smart contract deployment process. Attacker used Multicall3 to claim admin role before the official deployment script, then deployed a malicious proxy that forwarded to the audited code while using event manipulation and storage slot spoofing. After months, attacker minted 98M USPD and drained ~$1M in stETH.