Payy Network (Ethereum bridge contract) hack — September 2026

Payy, a privacy-focused stablecoin payments network built as an Ethereum rollup, had the bridge contract holding its users' deposits on Ethereum drained on 24 September 2026. The attacker made three burns, Payy's term for withdrawals, on Payy's own chain, all paid to one receiving address. Two were settled on Ethereum through the rollup contract's verifyRollup function: 1,828,589.38 USDC at 04:21 UTC in block 26,044,909, and 90,202.82 USDC at 09:30 UTC in block 26,046,439. The third, for 1 USDC, was paid early by a burn substitutor, a party that fronts a withdrawal and is repaid when the batch settles, and the rollup later reimbursed it. Payy's post-mortem puts the gross unauthorised withdrawals at 1,918,793.20 USDC, which is the figure recorded here; the two large payouts match this registry's own reading of the chain. Both settlements also carried ordinary small withdrawals to two other addresses, which are not part of the loss.

Payy said the stolen funds were users' non-custodial deposits to Payy Network and Payy Wallet. It suspended all network activity, including deposits, withdrawals, transfers and card transactions, and notified law enforcement, exchanges and blockchain analytics firms. The first payout was moved on within two minutes, sold through UniswapX for about 683.38 ETH by 05:39 UTC and split across four wallets. Early on 26 September three of those wallets made 19 deposits totalling 682.3 ETH into Tornado Cash; when Payy checked on 28 September the fourth still held 1 ETH and the 90,202.82 USDC of the second payout had not moved.

Payy's post-mortem, published on 29 September, says the attacker submitted an invalid burn proof that its deployed verifier accepted. The proof described a burn with no input notes, which Payy's circuit should never allow to withdraw anything, yet it verified against Payy's verification key using the pinned build of Barretenberg, the proving system Aztec develops for the Noir language, that Payy was running. Payy traces this to a soundness flaw in Barretenberg's small-subgroup IPA verifier that let a malicious prover forge a claim. Aztec fixed it in a code change dated 14 May 2026 and shipped the fix in version 5.0.0 on 13 July, but Payy was still on Barretenberg 3.0.0-manual.20251030 with Noir 1.0.0-beta.14 and says Aztec did not notify it of the vulnerability or the fix. Payy's recursive aggregation circuits and its Ethereum contract relied on the accepted proof rather than re-checking the burn, so the forged withdrawal was paid from rollup reserves. Payy says its analysis is supported by a separate post-mortem from Spearbit. The rollup had been reviewed by KALOS in February 2024, AuditOne in November 2024 and Spearbit/Cantina in July 2025.

In June 2026 Payy had disclosed and patched, in version 1.3.0, a separate critical flaw in its zero-knowledge circuit logic that could have allowed forged burn messages; no funds were lost then. Payy has not said whether affected users will be compensated and has given no date for resuming service.