Loading story…
An attacker exploited Payy Network’s Ethereum bridge contract, draining approximately $1.92 million USDC from user non-custodial deposits tied to Payy Network and Payy Wallet. Blockchain analysis found that two withdrawal batches sent funds to an attacker-linked address; a forged withdrawal was reportedly mixed with legitimate withdrawals in the first batch, with both batches calling the bridge’s verifyRollup function. The attacker converted the larger tranche through UniswapX into about 683 ETH and dispersed it across three addresses.
Payy halted deposits, withdrawals, transfers, card transactions, and Payy Wallet operations after detecting the compromise. The company notified law enforcement, cryptocurrency exchanges, blockchain analytics providers, and other relevant parties, but has not publicly identified the underlying vulnerability, disclosed attacker wallet addresses, announced a recovery timeline, or committed to a reimbursement plan for affected users.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
After the Ethereum bridge contract was exploited and drained, Payy suspended deposits, withdrawals, transfers, card transactions, and Payy Wallet functionality. The incident affected users' non-custodial deposits associated with Payy Network and Payy Wallet.
A second attacker-linked withdrawal batch transferred 90,202.82 USDC to 0xAa4985...B57E70 at 5:30 a.m. ET. Both withdrawal batches invoked the Ethereum bridge's verifyRollup function.
At approximately 04:21 UTC (12:21 a.m. ET), a withdrawal batch transferred 1,828,589.38 USDC from Payy's rollup contract to attacker-linked address 0xAa4985...B57E70. ExVul later assessed that the batch included a forged withdrawal mixed with normal user withdrawals.
Payy notified law enforcement, cryptocurrency exchanges, and blockchain analytics organizations about the attacker addresses to support tracing and disrupt potential cash-out activity. The company said its investigation was ongoing.
The first stolen tranche was moved to wallet 0xb483B...F3D38, converted through UniswapX into roughly 683 ETH, and distributed across three addresses, including transfers of approximately 282.38 ETH, 200 ETH, and 200 ETH.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exploit against the **Verus-Ethereum bridge** drained about **$11.58 million** in crypto assets, according to reports from Blockaid, PeckShield, and GoPlus. PeckShield said the attacker stole **103.6 tBTC, 1,625 ETH, and 147,000 USDC**, then swapped the proceeds into roughly **5,402 ETH**; the attacker wallet was reportedly seeded with **1 ETH from Tornado Cash**. Security researchers also identified attacker and destination wallets as the theft unfolded. Verus said its network was **halted**, with most block-producing nodes taking themselves offline after the attack’s effects appeared, while developers investigated the root cause and recovery options. GoPlus said the exploit may stem from **cross-chain message validation or signature forgery**, a **withdrawal logic bypass**, or an **access control flaw** in the bridge, which was launched to move assets between the privacy-focused Verus blockchain and Ethereum.
Jun 29, 2026
CrossCurve disclosed a roughly **$3 million** cross-chain bridge exploit after attackers abused a validation weakness, prompting the protocol to pursue legal action while investigators worked to trace the stolen funds. Reporting on the incident said the attack targeted the bridge’s transaction verification logic rather than a simple wallet compromise, underscoring how weaknesses in cross-chain message validation can let adversaries authorize fraudulent transfers and drain locked assets. A larger breach hit **KelpDAO**, where attackers stole about **$290 million** in `rsETH` by exploiting its LayerZero-based bridge path with effectively **`1-of-1` DVN verification**, allowing a forged packet to be accepted on Ethereum without a legitimate source-chain transaction. The theft was widely attributed to North Korea-linked **Lazarus/TraderTraitor**, and recovery efforts later included burning more than **117,000 rsETH** held by the exploiter on Arbitrum, restoring backing through an Aave-controlled recovery wallet, increasing bridge requirements to four independent attestors and 64 block confirmations, and beginning a migration to **Chainlink CCIP** after investigators characterized the incident as an operational and verification failure rather than a confirmed public smart-contract bug.
Jun 29, 2026
Hackers exploited a vulnerability in the Balancer DeFi protocol's V2 pools, resulting in the theft of over $120 million in cryptocurrency, with at least $99 million stolen in ETH. The attack targeted Balancer's Compostable Stable Pools and was traced to either a precision rounding error in the Vault’s swap calculations or faulty access control mechanisms, allowing the attacker to manipulate token swaps and balances. Balancer confirmed that the exploit did not impact its V3 pools and has paused affected pools while working with security researchers to investigate the incident. The company has warned users to be vigilant against phishing attempts and fraudulent messages purporting to be from its security team. Several other blockchain organizations connected to Balancer, such as the Berachain Foundation, Gnosis, Sonic, and Beefy, took emergency measures to protect user assets, including halting networks and freezing stolen funds where possible. Despite Balancer's history of multiple security audits and bug bounty programs, this incident highlights ongoing risks in DeFi protocols. A full post-mortem is expected once the investigation concludes.
Jun 29, 2026