Hack history / 2026 / Hack or exploit
Payy Network
Hack or exploit on Sep 24, 2026 · Bridge Logic Flaw
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$1.8M
dollars at the time
Returned
none listed
as the sources state it
Rank
#728
among thefts by dollars lost
What happened
Payy’s RollupV1 bridge processed a malicious verifyRollup batch containing an unauthorized 1,828,589.378132 USDC withdrawal to the attacker alongside ordinary withdrawals. The batch was submitted using Payy’s prover and validator infrastructure. ExVul reports that the malicious withdrawal had an all-zero burn hash that users cannot normally generate through Payy’s public circuits, indicating that the forged withdrawal entered during proving or aggregation rather than through an ordinary user withdrawal. Payy has confirmed the bridge exploit but has not yet established whether the cause was compromised prover/validator credentials or a proof-aggregation verification flaw
Details
- Date
- Sep 24, 2026
- Kind
- Hack or exploit
- Method
- Bridge Logic Flaw
- How in
- Bridge and cross-chain
- Target
- DeFi protocol
- Chains
- Ethereum
Related incidents
THORChain DEX 2026 · Hack or exploit · $10.7M
NEAR Intents 2026 · Hack or exploit · $3.8M
Harmony Bridge 2026 · Hack or exploit · $3.2M
Aztec Bridge 2026 · Hack or exploit · $2.1M
Chainflip AMM 2026 · Hack or exploit · $736K
NEAR Intents 2026 · Hack or exploit · $3.8M
Harmony Bridge 2026 · Hack or exploit · $3.2M
Aztec Bridge 2026 · Hack or exploit · $2.1M
Chainflip AMM 2026 · Hack or exploit · $736K
Cite this page
SwanBluechip, "Payy Network hack, Sep 24, 2026: $1.8M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htf5ea43f634/ (data as of 2026-10-31).