Payy halts all network functions after bridge exploit drains 1.83 million USDC
Payy has suspended every function of its stablecoin payment network, including card purchases, after an exploit drained its Ethereum bridge contract of 1,832,149.4681 USDC, worth roughly $1.83 million, on Thursday, September 24. The freeze halts deposits, withdrawals, transfers and card spending for all users while the company investigates, and it has not disclosed how many customer balances are affected.
- Payy paused deposits, withdrawals, transfers, and card purchases across its entire network after the bridge drain.
- Blockchain data shows 1,832,149.4681 USDC left a Payy rollup contract at Ethereum block 26044909, timestamped 4:21:23 a.m. UTC.
- Payy has not disclosed a transaction hash, a technical cause, a customer loss figure, or a restoration timeline.
- $1.83M USDC drained from Payy’s bridge
- 26044909 Ethereum block number recording the bridge contract outflow
- 4:21 a.m. UTC exploit time cited in Payy’s own incident statement
Payy said Thursday it had paused all Payy Network transactions after identifying an exploit that drained its Ethereum bridge contract, first reported by CryptoSlate. Its statement on X placed the incident at 4:21 a.m. UTC and confirmed the freeze covers deposits, withdrawals, transfers and card purchases alike. Blockchain records show the outflow landed on Ethereum at block 26044909, twenty-three seconds after the stated exploit time.
Payy’s $1.83 Million Bridge Drain Halts Every Transaction Type
The scope of Payy’s freeze goes beyond typical bridge incidents because it extends into card spending, not just stablecoin transfers. Users cannot deposit, withdraw, send transfers, or complete card purchases through the service while the investigation continues. That puts everyday spending, not only on-chain balances, on hold for an unspecified period.
The $1.83 million figure is far smaller than the $351.6 million hot wallet breach Bitget confirmed in a separate incident. Payy has disclosed no equivalent backstop.
Blockchain Data Pins the Drain to a Single Contract, Not a Total Loss Figure
Payy’s statement describes the bridge as drained of its full balance, but that description refers only to the one rollup contract tracked on-chain. The company gave no transaction hash and no technical explanation for how the exploit occurred, leaving the reported 1,832,149.4681 USDC as a single confirmed outflow rather than a complete accounting.
A fuller loss figure depends on Payy reconciling the bridge beyond that one transaction. The company has not said whether other contracts or customer-facing balances were touched.
No Restart Date or Customer Loss Count Has Been Published
Payy said it is following incident response guidelines and would publish further updates, but its initial announcement included neither a restoration timetable nor a count of affected users. The company did not state how many customers held active balances or attempted transactions during the pause, so the operational impact beyond the frozen network functions remains unmeasured.
The CCS read. Payy’s freeze exposes what happens when a stablecoin card provider has no disclosed insurance fund to fall back on. Unlike exchanges that can point to a reserve while withdrawals are paused, a bridge failure at a card issuer strands cardholders with no stated backstop and no timeline. Until Payy publishes a full loss breakdown, holders should treat frozen balances as unresolved exposure, not a temporary delay.
Payy has not said when deposits, withdrawals, transfers or card purchases will resume, nor whether customer balances beyond the drained contract are at risk. The company’s next disclosure, promised as part of its incident response process, will determine whether the $1.83 million outflow represents the full scope of the loss or only the visible portion of it.
