Chainflip (Tron vault memo refunds) hack — September 2026

Chainflip, a cross-chain swap protocol run by its own validator network, lost 736,442.17 USDT from its Tron vault between 01:44 and 03:10 UTC on 12 September 2026.

On most chains it supports, Chainflip receives swaps through dedicated contract functions. On Tron it read swap instructions from the memo attached to an incoming transfer, and it read the memo on any transaction reaching the vault, wrapped contract calls included. The attacker took a fetch transaction that Chainflip's validators had already signed, submitted it to the vault themselves and attached a malformed memo of their own. The network treated the memo as a separate swap, and when that swap appeared to fail it issued a refund, so six liquidity-provider withdrawals were paid out twice. The attacker ran the method eight times over about ninety minutes, starting small and roughly doubling the size each round; six attempts produced unauthorised payouts. One ordinary user swap of 115,654.41 USDT could not be paid and is still sitting in the vault.

Chainflip paused the network and now reads a memo as a swap instruction only when it comes with a plain TRX transfer or a direct TRC-20 transfer. Its restart plan is a runtime upgrade to process refunds and correct the accounting, then a validator engine upgrade carrying the fix, then every chain except Tron, with Tron last. Because the vault holds far less USDT than it owes, open TrxUSDT positions are being closed and each liquidity provider's Tron USDT balance has been recorded separately and set to zero pending recovery.

Chainflip says it is working with affected liquidity providers to make them whole and has flagged the moved funds with relevant parties. It has not said how compensation will be funded or when, and no freeze has been reported, so the outcome is recorded as unresolved.