Payy Network Ethereum Bridge Fully Drained in Exploit

Attackers exploited Payy's Ethereum bridge around 04:21 UTC on September 24, 2026, draining its full balance and prompting a service pause.

Payy Network said attackers exploited its Ethereum bridge contract at about 04:21 UTC on September 24, 2026, and drained the contract's entire balance. The bridge supported transfers between Ethereum and Payy Network, and Payy said the stolen assets were users' non-custodial deposits tied to Payy Network and Payy Wallet. The company paused or suspended deposits, withdrawals, transfers, card transactions, and wallet functions while investigating. It has not disclosed the vulnerability type or root cause, the stolen amount, or attacker addresses; one report also says transaction hashes were not disclosed and that Payy is tracing the funds. Payy notified law enforcement, exchanges, and blockchain analytics firms. The reports agree on timing and scope; wording differs only between 'paused' and 'suspended,' with no material factual conflict.

• Attackers exploited Payy Network's Ethereum bridge contract around 04:21 UTC on September 24, 2026, and drained its full balance.
• The bridge supported transfers between Ethereum and Payy Network; stolen assets were users' non-custodial deposits tied to Payy Network and Payy Wallet.
• Payy paused or suspended deposits, withdrawals, transfers, card transactions, and wallet functions while investigating.
• Payy has not disclosed the flaw type or root cause, stolen amount, or attacker addresses; one report also says transaction hashes were not disclosed.
• Payy notified law enforcement, exchanges, and blockchain analytics firms; one report says the company is tracing the funds.