Payy’s Ethereum Bridge Was Drained in a Single Rollup Transaction
Privacy-focused payments platform Payy has halted deposits, withdrawals, transfers and card transactions after an attacker drained roughly $1.83 million in USDC from its Ethereum bridge, effectively shutting down the company’s payment stack while investigators determine how the transaction was authorized.
The exploit occurred at approximately 04:21 UTC on September 24. Ethereum records show that a transaction interacting with Payy’s RollupV1 contract moved 1,832,149.4681 USDC out of the bridge through its verifyRollup function.
Almost all of the outflow — roughly 1.829 million USDC — went to a single address, while smaller transfers were included in the same rollup batch.
Payy subsequently confirmed that its Ethereum bridge contract had been “exploited and drained of its full balance.” The company paused all Payy Network transactions while beginning an investigation and following its incident-response procedures.
Payy later said it had contacted law enforcement and was working with multiple incident-response organizations. Addresses associated with the incident were shared with exchanges and blockchain analytics companies as investigators attempted to follow the stolen assets.
No restart timetable has been announced, and Payy has not publicly committed to reimbursing users or explained whether every customer balance represented by the drained bridge assets can be restored.
The distinction between the bridge balance and individual customer losses remains important. The transaction establishes that the Ethereum contract was drained, but Payy has not yet published a full reconciliation explaining how much of that USDC represented customer claims, operational liquidity or other balances.
Blockchain researchers subsequently traced the stolen stablecoins through a series of transactions in which they were converted into approximately 683 ETH and distributed among several addresses. Researchers have also reported interaction with Railgun, a privacy protocol that can make subsequent tracing more difficult.
The Exploit Hit the Infrastructure Under Payy’s Wallet and Card
Payy is unusual because it is not simply a bridge or decentralized finance protocol.
The company has been building an integrated stablecoin payments system consisting of Payy Network, Payy Wallet and Payy Card. Its consumer product allows users to hold and move stablecoins privately and spend USDC through a Visa-linked card.
Payy describes the underlying network as a privacy-focused Ethereum rollup designed to hide transaction details using zero-knowledge proofs while ultimately settling state updates on Ethereum.
That architecture turns the bridge into critical infrastructure. USDC deposited into the system is held by the Ethereum rollup contract while corresponding private balances exist inside Payy Network. If the assets backing those balances leave the bridge improperly, the problem reaches far beyond one smart contract.
That helps explain why Payy suspended the card as well as blockchain deposits and withdrawals.
Other stablecoin companies are also trying to combine blockchain settlement with familiar consumer financial products. Telcoin’s on-chain banking model, for example, similarly attempts to integrate digital-dollar balances, wallets and conventional financial services into one stack.
The attraction is obvious: users should not need to understand bridges, smart contracts or blockchain settlement to make an everyday payment.
The problem is that hiding that complexity from the customer does not remove it from the infrastructure.
Why the VerifyRollup Transaction Raises Difficult Questions
The most important unanswered question is how the malicious withdrawal made it through Payy’s rollup verification process.
According to L2BEAT’s technical analysis of Payy, state updates submitted through verifyRollup() are expected to contain an aggregated zero-knowledge proof and signatures from more than two-thirds of the current validator set.
The contract then processes the state update and associated withdrawals.
That means simply observing that the attacker called verifyRollup does not identify the vulnerability. Several very different failure modes could theoretically produce an unauthorized withdrawal, including a flaw in proof constraints, compromised signing credentials, problems in the verifier or another weakness in the rollup’s privileged infrastructure.
None of those possibilities has been confirmed by Payy.
Security researcher ExVul has alleged that the malicious batch was submitted using Payy’s recognized prover address and included validator authorization. If correct, that would focus attention on whether legitimate infrastructure was compromised or whether invalid withdrawal data was accepted despite apparently valid authorization.
Payy has not confirmed that interpretation, and it would be premature to conclude that its prover or validator private keys were stolen.
The situation resembles other crypto security incidents where the initial on-chain evidence reveals the effect before the exact mechanism is understood. Dave Finances recently covered how MultiversX paused its mainnet after a VM-level exploit attempt while engineers investigated how invalid state changes had been produced.
In both cases, getting the network moving again is only one part of the problem. The harder task is proving which state is legitimate and why the repaired system will reject the same attack path in the future.
Payy Had Already Patched a Critical ZK Circuit Flaw in June
There is another detail investigators will inevitably examine.
Payy dealt with a separate critical circuit vulnerability in June.
L2BEAT records that the earlier issue involved an aggregation-circuit bug that could have allowed forged burn messages capable of draining USDC from the rollup. The vulnerability was disclosed and patched before a publicly reported loss occurred.
There is currently no evidence that the September exploit used the same vulnerability.
Still, the similarity in potential impact makes Payy’s eventual post-mortem especially important. Investigators will want to know whether the latest withdrawal involved the proof system, validator authorization, privileged credentials or an entirely unrelated defect.
A previous vulnerability is not evidence that the same code failed twice. But when two issues potentially affect the mechanism responsible for releasing assets from a rollup bridge, the relationship needs to be addressed directly rather than assumed away.
A $1.83 Million Exploit Has Shut Down More Than $1.83 Million of Utility
The dollar value of the theft is relatively modest by crypto-hack standards.
The operational impact is not.
Payy’s pitch is that stablecoins can become ordinary money: private transfers, global payments and card spending without forcing consumers to think about blockchain mechanics.
That broader payments thesis is spreading rapidly. Companies such as Shift4 are already building infrastructure that allows merchants to accept stablecoin payments through familiar checkout systems, while infrastructure providers are trying to make blockchain settlement invisible to the end user.
Payy takes that idea further because the wallet, privacy layer and card depend heavily on the same underlying network.
That vertical integration is powerful when everything works.
When the base layer fails, however, the same integration concentrates the blast radius.
A bridge exploit did not merely interrupt bridging. Users lost access to transfers. Deposits stopped. Withdrawals stopped. Card transactions stopped.
In other words, a smart-contract security failure became a payments outage.
Privacy Infrastructure Creates an Additional Recovery Challenge
Payy is also building around privacy, which introduces a complicated trade-off during incident response.
Privacy-preserving financial infrastructure is attractive precisely because it prevents every payment, balance and counterparty relationship from becoming public information.
Companies such as Cycles are pursuing a similar principle by building private infrastructure for crypto and stablecoin settlement.
But during an exploit, investigators need the opposite: as much visibility as possible into which balances were affected, where the backing assets moved and which transactions represent legitimate users.
The Ethereum side of the Payy incident is unusually visible. Investigators can identify the bridge contract, see the USDC leaving it and follow subsequent public transfers.
The more difficult question is reconstructing the internal liabilities behind that bridge balance and ensuring legitimate private balances can be restored without creating additional claims or invalid state.
That reconciliation may ultimately be more important to users than recovering the stolen ETH itself.
The Next Payy Update Needs to Explain More Than How the Hacker Got In
The obvious question is what vulnerability allowed the drain.
But Payy’s eventual incident report needs to answer several additional questions.
Was the zero-knowledge proof itself valid? Were validator signatures genuine? Were any prover or validator credentials compromised? Did the contract correctly execute a malicious but apparently authorized state transition, or did a contract-level defect bypass expected checks?
Users also need to know exactly what the drained USDC backed, whether customer balances remain fully accounted for and what resources Payy can use to restore the bridge.
Finally, the company will need to explain what changes before card payments and withdrawals resume.
Crypto infrastructure has repeatedly shown that restarting quickly is not the same thing as recovering safely.
For Payy, that distinction is even more important because the company is selling something much closer to everyday financial infrastructure than a speculative DeFi application.
The entire point of a stablecoin card is that users should be able to treat their balance like money.
If the smart contract underneath that card can be drained and every payment function has to stop, then bridge security is no longer a backend engineering issue.
It is the reliability of the payment product itself.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape.