Stablecoin payment systems face a critical security blind spot: attackers are bypassing smart contract code entirely and targeting the infrastructure that manages transactions, the private keys that control funds, and the people who operate them. Three of crypto's largest payment-related incidents in 2025 demonstrate that the attack surface has fundamentally shifted, exposing weaknesses that even well-resourced exchanges and payment firms cannot easily defend.

Where Are Stablecoin Payment Hacks Actually Happening?

The 2025 attack pattern tells a clear story. In February 2025, Bybit suffered the largest single security incident in crypto history, losing approximately $1.5 billion in Ethereum (401,347 ETH). The attackers never exploited a bug in Bybit's own smart contracts. Instead, they compromised the third-party Safe{Wallet} interface that Bybit's signers relied on to authorize transactions. The attackers injected malicious code into the Safe{Wallet} web interface, causing Bybit's signing team to unknowingly approve a delegatecall operation that replaced the multisig contract's core logic with an attacker-controlled version. Once signed, the entire wallet was drained within minutes.

The second major incident involved UPCX, a payment protocol that lost approximately $70 million in 2025 when a single admin private key was leaked. The attacker used that key to upgrade the contract's implementation to a malicious version, then called a withdrawal function to drain all funds. Unlike Bybit, this attack required no social engineering or front-end compromise; it was purely a key management failure.

The third case, involving crypto payment firm MoonPay, shows that stablecoin security threats extend into the human realm. According to a 2025 U.S. Department of Justice forfeiture filing, the CEO and CFO of MoonPay were phished into transferring approximately $250,000 in USDT (Tether's USD Tether stablecoin) to an attacker-controlled address. The attacker impersonated a well-known figure and used typosquatting, swapping a capital "I" for a lowercase "l" in the sender's email address, nearly invisible in a sans-serif font. Tether later froze approximately $40,000 of the stolen funds, but the majority went overseas.

What Do These Attacks Reveal About Stablecoin Infrastructure Weaknesses?

Each incident maps to a distinct failure point in the payment ecosystem. The Bybit hack exposed four simultaneous weaknesses: endpoint security (the signing interface came from a third party with no independent verification), transaction verification (signers could not distinguish a normal transfer from a delegatecall on-screen), contract design (the proxy upgrade privilege had no timelock protection), and operational isolation (the signing environment was not physically separated from the everyday office environment). Even a well-resourced exchange cannot survive when multiple safeguards fail at once.

The UPCX incident underscores a fundamental principle: a leaked key plus contract upgrade privilege equals total control. The MoonPay case demonstrates that social engineering does not discriminate; even technically sophisticated executives at top payment firms can fall victim to carefully crafted phishing attacks.

How to Defend Stablecoin Payment Systems Against These Attack Vectors

• Signing Infrastructure Protection: Implement independent verification of transactions before signing, ensure the signing environment is physically isolated from everyday office networks, and use hardware security modules or air-gapped systems to prevent compromise of the signing interface itself.
• Admin Key Management: Never store admin private keys as a single holder; instead, use Multi-Party Computation (MPC) or multisig arrangements where multiple parties must approve key operations, and implement timelocks (such as a 48-hour delay) on contract upgrades to allow teams to detect and block anomalies before they take effect.
• Operations Staff Security: Require independent verification of recipient addresses before any transfer, implement address whitelisting for large transactions, enforce a cooling-off period before funds move, and conduct ongoing security awareness training to help executives recognize typosquatting and other social engineering tactics.

The practical takeaway for anyone responsible for a crypto payment system is clear: defend all three attack surfaces separately. Your signing tools, your admin keys, and your operations staff each require distinct controls and monitoring. The attack surface has moved beyond smart contract bugs to the infrastructure that manages those contracts and the people who operate them.

Stablecoin freezability, a feature built into USDC and USDT contracts that allows issuers to freeze funds at a specific address, helped recover part of the MoonPay loss after the fact. However, only a fraction of stolen funds were recovered, demonstrating that prevention is far more effective than post-hoc freezing. For payment companies relying on stablecoins like USDT and USDC, understanding the permission model and freeze capability of the stablecoin contracts themselves is essential to the overall security posture.

As stablecoin adoption accelerates in payment infrastructure, the 2025 incident data suggests that the next generation of payment security will require equal attention to signing infrastructure, key management, and human factors. The contracts themselves are only one layer of the defense.