Sep 2025 - Unknown Bruce Lee Polygon Contract Upgrade Locks Funds - $20m (Global)
From the description by Bruce Lee, the smart contract was a UUPS proxy implementation.
Unfortunately, due to botching the upgrade, the developers lost their Admin and Upgrade roles.
A potential explanation of the issue:
"ig the problem is that they used a individual "FundPool" contract for the funding (user send funds?)
but then they upgraded to a proxy, didnt know that the storage dont upgrade too and now the admin roles link to empty storages"
Losses are widely reported as $20m.
The initial desperate request on Telegram:
"Hey Guys I meet some problem
My contacts fund cannot be withdrawn
About 22m"
There does not appear to be any recovery possible.
Further Analysis
An issue arose from a botched upgrade of a UUPS proxy smart contract, where developers lost their Admin and Upgrade roles. The problem likely stemmed from using an individual "FundPool" contract for funding, which was then upgraded to a proxy without realizing that the storage would not be upgraded along with it, causing the admin roles to link to empty storage. As a result, $20 million in funds are reportedly lost, and recovery seems impossible. The problem was first flagged in a Telegram message about difficulties withdrawing funds.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
Yala Protocol Dormant OFTU Unauthorized Mint And Bridge > > < < Kame Aggregator Swap Function Arbitrary Executor Call Bug
Sources/Further Reading
Who Got Rugged - Rekt News (Dec 31)
Bruce Lee - "Hey Guys I meet some problem. My contacts fund cannot be withdrawn. About 22m." - Telegram (Dec 31)
Bruce Lee - "It is a UUPS proxy, but the implementation contact was set a wrong impl. So I lost a default admin role and upgrade role" - Telegram (Dec 31)
Yannick - "just played around and i would say the $22m are gone" - Telegram (Dec 31)
Yannick - "ig the problem is that they used a individual "FundPool" contract for the funding (user send funds?). but then they upgraded to a proxy, didnt know that the storage dont upgrade too and now the admin roles link to empty storages" - Telegram (Dec 31)
Bruce Lee - "So the contract ‘ pol balance is 22 m now , and how can I contract to polygon official to recover my lost" - Telegram (Dec 31)
The Account Is Listed As Fifth Largest - PolygonScan (Dec 31)
Bruce Lee - "im too tired but i want to upgrade it quickly before i go to bed worst case 22m gone" - Telegram (Dec 31)
Bruce Lee - "Yeah" - Telegram (Dec 31)
Yannick - "I guess @JUDAOGlobal (not sure if its them) made a presale and collected 77 MILLION POL. But the hiverr dev forget to reinitialize the contract while changing the implementation contract to a new contract." - Twitter/X (Dec 31)
Polygon Contract Where Funds Are Locked - PolygonScan (Dec 31)
Polygon Contract Creation - PolygonScan (Dec 31)
JUDAO Global Twitter/X (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|