Chainflip resets TRON USDT LP balances to zero after $736K double-payout exploit
By 8bitcrypto
September 17, 2026
Chainflip is restarting after a September 12 TRON vault exploit that drained 736,442.17 USDT when an attacker forced six liquidity-provider withdrawals to pay twice—then resetting live trxUSDT LP balances to zero while recording pre-migration claims on-chain for later recovery, per the project’s September 15 “Getting Chainflip back up and running” post and CryptoSlate follow-ups dated September 17. For Rug Room readers, the desk fact is not a quiet patch note: cross-chain swap LPs see zero active TRON USDT while repayment timing and funding remain undisclosed.
Between 01:44 and 03:10 UTC on Sept. 12, Chainflip says the attacker took a validator-signed fetch transaction, resubmitted it to the vault with a malformed memo, and tricked the witnessing layer into treating that memo as a failed swap—triggering a refund on top of a normal LP withdrawal. The team counts six successful double payouts inside roughly ninety minutes of probing. Other supported chains and remaining funds were described as unaffected in the initial disclosure. A pending user swap of about 115,654 USDT that could not clear during the incident was described as still sitting in the vault and recoverable after a secure restart.
The fix tightens memo parsing: a memo now counts as a swap instruction only when it rides a plain TRX transfer or a direct TRC-20 token transfer. Transfers wrapped inside another contract call are excluded, which blocks memos attached to Chainflip-signed wrapped fetches. Side effect: smart-contract wallets and aggregators that wrap TRON transfers will find vault swaps harder; Chainflip says none of its current integrations use that path today. The team also says it is reviewing memo handling on every supported chain and adding monitoring for duplicate payouts.
Restart sequencing, as published: runtime upgrade for stuck refunds and accounting fixes; engine upgrade carrying the exploit patch through validator consensus; then swaps and quoting resume on every route except TRON until witnessing catches up. By mid-September, Chainflip said non-TRON services were back while TRON stayed paused—attribute live status to official channels, not to secondary headlines. Node operators were told to watch for binary releases before consensus on the engine upgrade.
Because the vault holds less USDT than LPs are owed, the accounting path closes open TrxUSDT orders and loans, writes each LP’s pre-migration balance to a separate on-chain recovery record, then zeroes the live trxUSDT account. Chainflip pledges to make LPs whole and says it is contacting affected providers directly, but public posts do not name a funding source, payout calendar, or final recovered amount. That gap is the Rug Room tell: claim tokens are not cash in the wallet.
For NFT collectors who route settlements through cross-chain swap aggregators—including paths that touch TRON USDT when moving proceeds from Solana or Ethereum marketplace sales—the incident is an infrastructure risk file. Native-asset bridges and swap protocols that parse memos or witness foreign-chain deposits can fail open even when the NFT marketplace itself is fine. Treat recovery promises as project statements until payments clear on-chain or in disclosed bank rails.
What Thursday’s file proves is narrow. Chainflip documented a 736,442.17 USDT TRON double-payout exploit, shipped a stricter memo check, restarted non-TRON routes, and will zero live trxUSDT LP balances while parking owed amounts in separate on-chain records. What it does not prove is when LPs are paid, how much is recovered from flagged funds, or that every memo-based bridge is safe. Watch TRON re-enable notices, LP payout proofs, and any post-mortem PR with full technical detail.
For 8bitcrypto readers on September 17, the clean Rug Room line is Chainflip bringing swaps back while TRON USDT LP screens go to zero—recovery claims on-chain, cash schedule still off the public tape.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
