Specter flags $1.83M USDC leaving Payy Ethereum rollup as protocol stays silent
By Node Zero
September 24, 2026
A single Ethereum transaction moved about $1.83 million in USDC out of a Payy Network rollup contract early on September 24, 2026, and blockchain investigator Specter flagged the privacy payment network as possibly drained. CryptoTimes verified the USDC transfer against Ethereum records: the call hit function verifyRollup on contract 0x367c1eaF14AA06b78ce76bd0243297de79d85270 in block 26044909 at 04:21:23 UTC, moving 1,832,149.4681 USDC with no ETH value and about $2.33 in fees. That is the Dev & Protocol Pulse lead for Orange County desks: a ZK-rollup state-update path that just escrowed a multi-million dollar stablecoin burn-out—while Payy itself has not confirmed a hack, a root cause, or a user-loss total.
Where the dollars went on-chain. Almost the entire outflow landed at 0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70, which received 1,828,589.3781 USDC. Two smaller legs of 3,165.71 USDC and 394.31 USDC went to separate addresses; the three transfers sum to the full contract outflow. CryptoTimes notes that the largest recipient appears on Specter’s published address list for the incident. Attribute those balances and the fee figure to that wrap—do not invent a reconciled TVL figure for Payy’s remaining escrow that the source does not publish.
What Specter claims about the follow-on path. Specter says the operator funded the move through Railgun, then swapped USDC for ether and split proceeds across three addresses. Its flowchart shows intermediate inflows from Payy and Railgun, then ether outflows near roughly $534,000, $754,000, and $134,000. CryptoTimes independently confirmed the Payy→USDC contract transfer and the primary receiving address; it did not independently confirm the Railgun funding or the ether distribution. Keep that split explicit: on-chain USDC exit is verified; laundering-path detail remains Specter’s attribution until other desks or Payy publish matching traces.
Why verifyRollup matters for protocol readers. Payy markets itself as a privacy-focused stablecoin payment network built as a zero-knowledge rollup on Ethereum—off-chain execution with compressed proofs posted back to L1. Calling verifyRollup is part of how a rollup’s state is accepted on the main chain; naming the function is not the same as proving a bug, a stolen prover key, a malicious validator quorum, or an authorized withdrawal. L2BEAT’s Payy discovery notes that RollupV1 escrows USDC backing notes, processes deposits and withdrawals through proven state updates, and that privileged upgrade and root-overwrite paths sit with a 2/4 Payy multisig without a timelock. Treat those trust assumptions as standing risk context—not as a confirmed root cause for today’s outflow.
What is still unknown—and what not to invent. Payy had made no public statement when CryptoTimes filed, and Specter’s own wording is conditional: the network “may have been” drained. Nobody has established whether user notes were hit, whether the $1.83 million is the full loss, or whether the successful verifyRollup call was authorized. Several secondary outlets have already labeled it a confirmed hack; that overstates the primary record. Leave yesterday’s Cosmos/Neutron recovery tape (LN 9609) and this morning’s Duelbits PeckShield outflows (LN 9665) closed—different stacks, different monitors.
Why NFT and settlement desks still file this under protocol pulse. Collectors and marketplace operators increasingly settle bids in USDC and park operational floats on privacy-adjacent or L2 payment rails. A morning where a labeled Payy rollup escrow posts a multi-million USDC exit through the same verification function that normally finalizes state is a live reminder that ZK payment products inherit upgrade, prover, and validator trust assumptions even when the marketing pitch is “privacy payments on Ethereum.” What to watch next: any Payy incident note, whether Specter or other forensics publish a method call beyond Railgun staging, and whether L2BEAT or Payy updates the RollupV1 risk surface after the block 26044909 transfer.
Operational hygiene while the cause stays open: treat Specter’s “may have been drained” language as the ceiling of confidence, separate privacy-rollup settlement floats from NFT inventory cold storage, revoke stale approvals on unrelated bridges and routers after any labeled USDC drain alert, and wait for a protocol post-mortem before assuming every Payy user note is compromised. The desk story is a verified ~1.83 million USDC contract outflow through verifyRollup—not a closed exploit CVE.
Bottom line: Specter flagged roughly $1.83 million in USDC leaving Payy’s Ethereum rollup via verifyRollup on Sept. 24, with most funds to one address, while method, user impact, and total loss remain unconfirmed by the protocol.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
