Payy Halts Network After $1.83M Ethereum Bridge Exploit Hits Platform

Payy Network halted transactions after an attacker drained about $1.83 million from its Ethereum bridge on September 24.

The network suspended deposits, withdrawals, transfers and card transactions while investigating the breach. Payy is working to determine how the attacker gained access to the bridge contract and said it has followed its incident-response procedures.

The company also notified law enforcement and is working with outside organizations to investigate the exploit and assess its impact.

Ethereum Bridge Suffers Major Drain

The attack began when a transaction called Payy’s verifyRollup function and moved 1,832,149 USDC from the bridge contract. Nearly $1.83 million went to a single address, with smaller transfers accounting for the remaining amount.

Related: Why Did Crypto Crash Today? $450 Million in Long Liquidations Amplified the Sell-Off

Investigators later traced part of the funds through swaps into Ethereum. Specter said the attacker also used Railgun, making the movement of the assets harder to track.

Prover Key Raises Security Questions

ExVul alleged that a forged withdrawal was included in a verified batch and pointed to Payy’s prover and validator keys. Payy has not confirmed those claims.

Sprunky said the attacker converted the stolen USDC into about 683 ETH and spread the funds across multiple addresses. Those details also remain unconfirmed by Payy.

The breach has raised questions about the controls protecting the bridge and the funds that remain there. Payy said it will provide further updates as the investigation continues.

Related: Crypto Heads Into Q4: How BTC, ETH, XRP, SOL, and BNB Are Closing Q3