Payy bridge exploit freezes cards, 1.83M USDC moved

Payy halted deposits, withdrawals, transfers and card payments after reporting that an exploit moved 1,832,149.4681 USDC from a Payy rollup contract on Ethereum at 4:21:23 a.m. UTC on Sept. 24 in block 26044909. The company said the bridge contract’s balance was drained and paused all Payy Network transactions while it investigates.

The operational pause prevents users from depositing to or withdrawing from Payy, sending stablecoin transfers on the network, and completing purchases with Payy-issued cards processed through the app. Payy did not disclose how many users held active balances at the time or how many payments were blocked.

Payy flagged a single on-chain contract outflow but did not publish a transaction hash, a total loss figure or a technical explanation of the exploit. The visible transfer reflects one contract-level movement; the full financial impact depends on Payy’s internal accounting and any additional transfers the company has not disclosed.

Bridges link an application’s rollup or internal ledger to mainnet Ethereum, allowing tokens such as USDC to move between chains or between a layer‑2 environment and Ethereum. When a bridge contract that holds liquidity is emptied, the platform cannot move tokens on or off its network, which prevents deposits, withdrawals and card settlements.

Payy reported that it is following incident response procedures and will publish updates. The company has not identified a suspect, provided a technical postmortem, specified whether customer balances were affected or given a timetable for restoring transaction functions. Users and counterparties must await further statements for total loss figures and a restoration schedule.