Payy halts all transactions after confirming Ethereum bridge drained of full balance
By Crypto Wire
September 24, 2026
Payy Network confirmed on September 24, 2026 that its Ethereum bridge contract was exploited at about 04:21 UTC and drained of its full balance, then paused every network transaction while investigators work the incident. CoinEdition quotes Payy’s own update: deposits, withdrawals, transfers, and card transactions are all suspended under incident-response guidelines, with law enforcement notified and outside organizations engaged. That is the Rug Room lead for Orange County desks—and a distinct follow to this morning’s Specter-only outflow note (LN 9667): the privacy payments network has now owned the drain and frozen the product surface, including cards.
What Payy’s pause covers. Phemex and PANews both summarize the team’s statement that the entire bridge-contract balance was transferred out and that security incident-response protocols are underway. While the investigation continues, users cannot deposit, withdraw, transfer, or run card flows on Payy. The company said it will publish regular updates on exploit details and recovery. Attribute the full-service pause and law-enforcement notice to those wraps—do not invent a published recovery dollar figure or a restored-service ETA Payy has not given.
On-chain numbers that still match the morning tape. CoinEdition repeats that a verifyRollup call moved 1,832,149 USDC from the bridge, with nearly $1.83 million landing at one address and smaller transfers making up the rest. Specter’s earlier Railgun-and-ETH-swap framing remains investigator color; Payy has not confirmed those laundering steps in the statements cited here. Leave LN 9667’s Specter/CryptoTimes address-level walkthrough closed and point readers there for the first outflow snapshot—today’s unused angle is the official confirmation plus the network-wide halt.
Unconfirmed method claims stay labeled. Security outlet ExVul alleged a forged withdrawal sat inside a verified batch and pointed at Payy’s prover and validator keys; CoinEdition is explicit that Payy has not confirmed those claims. A separate Sprunky note that stolen USDC converted into about 683 ETH across multiple addresses is likewise unconfirmed by Payy. Desk rule: publish the attributed allegations as open questions, not as settled root cause. Until Payy or a joint forensic note names the access path, the confirmed facts are drain + full pause + investigation.
Why Rug Room files the halt for NFT and settlement readers. Privacy stablecoin payment rails and card payouts are increasingly adjacent to how collectors move USDC between marketplace bids and off-ramp cash. When a network that marketed ZK-rollup payments pauses deposits, withdrawals, transfers, and cards after confirming a full bridge drain, the operational message is immediate: treat any remaining Payy balances as frozen inventory until the team restores routes and publishes a method note. The same-day Meter Passport unbacked-mint alert (LN 9673) and Duelbits PeckShield outflows (LN 9665) stay closed as separate stacks—today’s unused angle is Payy’s self-declared freeze after confirming the bridge emptied. What to watch next: whether Payy confirms or rejects the ExVul prover/validator-key theory, whether card partners stay offline beyond the investigation window, and whether recovered funds or insurance language appears in later updates.
How this sits beside the morning Specter desk without repeating it. LN 9667 filed when Payy was still silent and Specter only said the rollup “may have been” drained. Hours later, Payy’s own post moves the story from suspected outflow to confirmed exploit plus a hard product pause that includes cards—material for collectors who treat privacy payment apps as USDC off-ramps. Keep the verifyRollup and ~$1.83 million USDC figures as the shared on-chain spine; keep Railgun hops and ExVul key theories as attributed, still-unconfirmed method color.
What not to invent: that every Payy user note is wiped beyond the drained bridge escrow, that ExVul’s key claims are proven, that the ~$1.83 million figure equals final customer liability after recoveries, or that services will resume on a named date. Stick to Payy’s pause language and attributed on-chain totals. Operational hygiene while the halt holds: do not send fresh USDC into Payy deposit addresses, revoke stale approvals on unrelated bridges after the alert, separate NFT cold storage from any privacy-rollup payment floats, and wait for an official all-clear before treating Payy cards as live settlement again.
Bottom line: Payy confirmed its Ethereum bridge was drained of its full balance at about 04:21 UTC on Sept. 24—matching the ~$1.83 million USDC verifyRollup tape—and paused deposits, withdrawals, transfers, and card transactions while investigating with law enforcement and external partners.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
