Payy Network (Ethereum bridge contract) hack — September 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Cross-chain bridge |
| Loss | $1,832,149Price at time of incident |
| Method | Other or undisclosedA crafted transaction to the rollup contract's verifyRollup function released the bridge's whole USDC balance; Payy has not said whether a proof check, a permission check or a key failed |
| Chains | Ethereum |
| Outcome | Unresolved |
What happened
Payy, a privacy-focused stablecoin payments network built as an Ethereum rollup, had the bridge contract holding its users' deposits on Ethereum drained of its full balance at 04:21 UTC on 24 September 2026. A single transaction calling the contract's verifyRollup function, confirmed in block 26,044,909, moved 1,832,149.47 USDC out of the contract, 1,828,589.38 of it to one receiving address and the rest in small amounts to two others. This registry read the transfers from the chain.
Payy said the stolen funds were users' non-custodial deposits to Payy Network and Payy Wallet. It suspended all network activity, including deposits, withdrawals, transfers and card transactions, and notified law enforcement, exchanges and blockchain analytics firms. It has not disclosed the vulnerability. Specter Investigation traced the USDC through the Railgun privacy protocol, where it was converted into about 683 ETH and split across several addresses. Some early coverage classified the incident as an access-control failure, but Payy has confirmed no mechanism, so the vector is recorded as undisclosed.
In June 2026 Payy had disclosed and patched, in version 1.3.0, a separate critical flaw in its zero-knowledge circuit logic that could have allowed forged burn messages; no funds were lost then. Payy has not said whether affected users will be compensated and has given no date for resuming service.
Sources
- Cyber Security News, quoting Payy's statementSecondary · retrieved 2026-09-25
- Crypto BriefingSecondary · retrieved 2026-09-25
- Ethereum transaction logs, read by this registryOn-chain · retrieved 2026-09-25
Changes to this entry
- Recorded the day after the incident. The amount is the 1,832,149.47 USDC that left the bridge contract in the exploit transaction, read by this registry from its logs; Payy itself has not published a figure.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Payy Network (Ethereum bridge contract) hack — September 2026", iTokenly, accessed 2026-09-25, https://itokenly.com/hacks/payy-network-bridgehttps://itokenly.com/hacks/payy-network-bridgePermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.