Chainflip (Tron vault memo refunds) hack — September 2026

Chainflip, a cross-chain swap protocol run by its own validator network, lost 736,442.17 USDT from its Tron vault between 01:44 and 03:10 UTC on 12 September 2026.

On most chains it supports, Chainflip receives swaps through dedicated contract functions. On Tron it read swap instructions from the memo attached to an incoming transfer, and it read the memo on any transaction reaching the vault, wrapped contract calls included. The attacker took a fetch transaction that Chainflip's validators had already signed, submitted it to the vault themselves and attached a malformed memo of their own. The network treated the memo as a separate swap, and when that swap appeared to fail it issued a refund, so six liquidity-provider withdrawals were paid out twice. The attacker ran the method eight times over about ninety minutes, starting small and roughly doubling the size each round; six attempts produced unauthorised payouts. One ordinary user swap of 115,654.41 USDT could not be paid and is still sitting in the vault.

Chainflip paused the network and now reads a memo as a swap instruction only when it comes with a plain TRX transfer or a direct TRC-20 transfer. Its restart plan is a runtime upgrade to process refunds and correct the accounting, then a validator engine upgrade carrying the fix, then every chain except Tron, with Tron last. Because the vault holds far less USDT than it owes, open TrxUSDT positions are being closed and each liquidity provider's Tron USDT balance has been recorded separately and set to zero pending recovery.

Chainflip published software version 2.2.13 on 15 September and brought the rest of the network back on 16 September, with Tron still excluded until its witnessing layer catches up. At the restart it closed every open order, strategy and lending position tied to Tron USDT, copied what each provider held into a separate on-chain balance so the amount owed stays tracked, and set the live accounts to zero: an LP account now reads 0 for trxUSDT.

Chainflip has been explicit that the tracked figures are not a payment. It says it is working with affected liquidity providers to make them whole and has flagged the moved funds with relevant parties, but it has not said where compensation would come from or when, and no freeze or recovery has been reported. The outcome is recorded as unresolved.